Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 10:00
Static task
static1
Behavioral task
behavioral1
Sample
e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.exe
Resource
win10v2004-20231127-en
General
-
Target
e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.exe
-
Size
6.9MB
-
MD5
5aff62c035c273e6c3696a8b81ed46e2
-
SHA1
43a29119592ab5e150623064bda25252b5eac8a5
-
SHA256
e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45
-
SHA512
320920e8a3bbff94d61aa1e742f544c429bf7eb252c2e5d8197c35676221f2233799b743965a7934a8f723a3d4b970fa5afc00d672e898ed85e762779e973691
-
SSDEEP
98304:7CtQAsI29jHcxWjRTp6azZzB8hi4ZoEiAmP+xhctqd60dVADjhSF1O8lw3kBL7l7:QstjRJ/4ZoSQQhtd6sWDlSrM0BLRrzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 4348 wmaformat.exe 1868 wmaformat.exe -
Loads dropped DLL 3 IoCs
pid Process 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\WMAFormat\bin\x86\is-64TFA.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-6BJ55.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-2PDHU.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9GTL1.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-HI1GJ.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-4H9KA.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-G4SEF.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-04Q86.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CNTP8.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-QRH3L.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-35AVC.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CCO9V.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-VKJVK.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EM1SD.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-NO00D.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\lessmsi\is-QVUUF.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-A917R.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-N4R4T.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-L1ABC.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KM2FF.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-4AD7H.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-QGFH0.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File opened for modification C:\Program Files (x86)\WMAFormat\wmaformat.exe e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-41SOV.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FJ5EV.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-E9U5D.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-AT5G3.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-N4A5B.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-HR3JR.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-503RV.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-71Q66.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-2AFD3.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MCJUN.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-ED4GG.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-C83SQ.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9KDFF.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-N7OSV.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\is-TE2JT.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File opened for modification C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-B1O2E.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-3NN1O.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-UEAUE.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\is-MA8TM.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-Q4VPK.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-8KG1F.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RAQJ9.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-UAUO6.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-8FSG5.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-D7JHU.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-8FAIE.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-ODKJM.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-7S6SH.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-QBA1Q.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-VILRH.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-AJ2GL.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-E60RI.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GB56N.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-ONGRQ.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MHEJI.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-PNV0B.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-0N9MI.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EETGU.tmp e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4136 wrote to memory of 2564 4136 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.exe 88 PID 4136 wrote to memory of 2564 4136 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.exe 88 PID 4136 wrote to memory of 2564 4136 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.exe 88 PID 2564 wrote to memory of 3776 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 91 PID 2564 wrote to memory of 3776 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 91 PID 2564 wrote to memory of 3776 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 91 PID 2564 wrote to memory of 4348 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 92 PID 2564 wrote to memory of 4348 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 92 PID 2564 wrote to memory of 4348 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 92 PID 2564 wrote to memory of 2408 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 96 PID 2564 wrote to memory of 2408 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 96 PID 2564 wrote to memory of 2408 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 96 PID 2564 wrote to memory of 1868 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 95 PID 2564 wrote to memory of 1868 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 95 PID 2564 wrote to memory of 1868 2564 e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp 95 PID 2408 wrote to memory of 3292 2408 net.exe 97 PID 2408 wrote to memory of 3292 2408 net.exe 97 PID 2408 wrote to memory of 3292 2408 net.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.exe"C:\Users\Admin\AppData\Local\Temp\e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\is-FBRRK.tmp\e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp"C:\Users\Admin\AppData\Local\Temp\is-FBRRK.tmp\e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp" /SL5="$50160,6990075,68096,C:\Users\Admin\AppData\Local\Temp\e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:3776
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
PID:4348
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
PID:1868
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:3292
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD55cad7fea412ba1f07610881fa0d782ec
SHA11a9b67aad35437851fd8137510a86854d0a68366
SHA256192e0f856d8500d346a0a917719b8eaed5d673967554848d1a52066b6f1a97e2
SHA512bfe5bbd8b0aae9e51db7f8edc6e90de6244e15cd3bec38344ab55d1b9ec77a8a47c98d8afc52b509e658fd205df8b2ff6a61620e579ff2f320cebda5faf45728
-
Filesize
1.3MB
MD5e70cd927a4731c57d70819e77b416553
SHA1c2580932a4047de1a27e37d73d2d3f11f99f88b1
SHA2565e154231c232c277046083f3ca60bae79b11e76d9b60f585d324e30930dc4be0
SHA5128fe23d2d81e3e0f52a5da860312ca23f78c9b9840798b2e46ec26afcc4374fbcfe2922992ffae9df291c4ab448dbd25d84884c1bbddaba810a1088edc5352055
-
Filesize
585KB
MD51b03dce0ee069466487b487c418fe4cd
SHA15b0eae33f9a20dbb580438d7cac88e64a06ae0c8
SHA25623391444daf60254d55a60de9f175ee94ad9514f77b192b53f39869d01f3f2d1
SHA512bf7752aa52e05523852110cfb49324fe9f4f25046edf534c4ac5df878b44b01c5139f28afeaa4d070d35110a846e4e893b96394a168bed152a96e58d1457f202
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-FBRRK.tmp\e73891ce3a15c094d64b8a0bf2d846b2193af9619c489c0ea1cd7a9e37885f45.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4