Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 10:56
General
-
Target
05edb3c05bd7576572a19ed55739986b205103c9475a4671e64432a55f95c93f.exe
-
Size
6.9MB
-
MD5
81df7e0f2ff4f1b3ea55dad10be6a532
-
SHA1
186f339bb68b185e281b98d787a041679fa94a96
-
SHA256
05edb3c05bd7576572a19ed55739986b205103c9475a4671e64432a55f95c93f
-
SHA512
75d1200e9741048d8a2e3a90ccb7b2345ca91683856543a91c949c39b42dd67d41c81ac7bf0bba299181951c474289fc8e7728a2f89ccba26761bb8c2e860ddf
-
SSDEEP
98304:VCtQAsI29jHcxWjRTp6azZzB8hi4ZoEiAmP+xhctqd60dVADjhSF1O8lw3kBL7l7:KstjRJ/4ZoSQQhtd6sWDlSrM0BLRrzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05edb3c05bd7576572a19ed55739986b205103c9475a4671e64432a55f95c93f.exe"C:\Users\Admin\AppData\Local\Temp\05edb3c05bd7576572a19ed55739986b205103c9475a4671e64432a55f95c93f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-N04CS.tmp\05edb3c05bd7576572a19ed55739986b205103c9475a4671e64432a55f95c93f.tmp"C:\Users\Admin\AppData\Local\Temp\is-N04CS.tmp\05edb3c05bd7576572a19ed55739986b205103c9475a4671e64432a55f95c93f.tmp" /SL5="$A0064,6990075,68096,C:\Users\Admin\AppData\Local\Temp\05edb3c05bd7576572a19ed55739986b205103c9475a4671e64432a55f95c93f.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c7e0260707b0f2b8019eb71b60898861
SHA1af87c53909502c2ccc7d120dadfeaa5ebe8a0c68
SHA256485fc10702989888cc62eac0f6c483ca7e68545b2e3eb000fc28bb9e4b44b2c0
SHA51244834881d361f6b02b4ab9491c27f547513839139e1a830e6e1b41c96f612081c00092cf2fa548c2cec984c742dfef6546a86f19b041b5887dac137059de2fba
-
Filesize
1.6MB
MD5d8b7334b3bbf777351ac313d277349a0
SHA1a57cd209485b07134343764494245228e7d6e908
SHA256d73072ce9d51ad026da8979529389675785993d399157d256c82c2caec36e3e0
SHA512700ac0b339fb832322021b29511b4b263c8902e11465e34af22d42ce69618153f8bbbdb1ebd4bae0df3aadaddf8ee35ba0c661e83be53b0a830236296bc02ff9
-
Filesize
1.4MB
MD51dc34b2f5a22ef07a5262f1b4a557177
SHA153cb2880ab108c41c483120dba657ef26af5029a
SHA256d95d7d77681f6b01dd1d02539a2449ffa6933caff7b13256b203429ddde0eff1
SHA512b07515bc6e44cc1bd3988cd862d4f39ca3223a83aa17904899f92f84a7d961464ae85a8f42587af2be97ce442bc43d3b0e3d510d8ce31d29b7ed847c624c9834
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
44KB
MD5bd9122e6046b16d2292f92a164c99c65
SHA1fa5a53f8f6dc5ef7cb36b4ad069b4c3adee6ee1a
SHA256e537c72d2a0f6aed30c65e40dd7bc7c0fa71fdd7487b536ab6a1d6164301b88a
SHA512b476b46dc9a8ae1052bfeddfcff7ae696b0c5c9d130b6ca1b234a945258b07196371e1f7a63519ce3d7e82d576766004fe7dffa4d68063729eb11d5c27b32510
-
Filesize
8KB
MD5763f6b288cb78ef1019a76967098be29
SHA1834a5896bc38d143d2a8977b4900bc00186312e5
SHA25642b9d061c5e8873ed460017625a486d6026e5682ebcd02ebfff7b89b587a68d1
SHA512fb13923b8c96c98e3052d3a595d5e021242b1c3ed3f2f9694fa38f48c1278e8e8bacf72419b5a794d16aa174a1a43a38bbdbf985bc28393931cc6cd2a4e13843
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB