Analysis
-
max time kernel
122s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11-12-2023 10:37
General
-
Target
b1bcc65da97e12decb2ab90c48cd09f1262d9f5d6805ae4336419050efab3e52.exe
-
Size
6.9MB
-
MD5
34da782e9e65de38f4e7f8fdd9492691
-
SHA1
cbc2dfa683a8144f90bfa87df78a22e03cb9c8cb
-
SHA256
b1bcc65da97e12decb2ab90c48cd09f1262d9f5d6805ae4336419050efab3e52
-
SHA512
653c6453b862973eff557ba35f32b2a18e5644264817fc5cec69d4d7c5847826f182bdd2f6c68e8f4bff8b1ba666e4e54ffc54b94d5f7a591a52da6b3cfbe55f
-
SSDEEP
196608:NH/2cOhoGEpX+jRFRvz29jgM7+3Utny3r/mvZO0agzj:EcOhoGE1ArRvqlgM7xtAT0Hzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1bcc65da97e12decb2ab90c48cd09f1262d9f5d6805ae4336419050efab3e52.exe"C:\Users\Admin\AppData\Local\Temp\b1bcc65da97e12decb2ab90c48cd09f1262d9f5d6805ae4336419050efab3e52.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8A82V.tmp\b1bcc65da97e12decb2ab90c48cd09f1262d9f5d6805ae4336419050efab3e52.tmp"C:\Users\Admin\AppData\Local\Temp\is-8A82V.tmp\b1bcc65da97e12decb2ab90c48cd09f1262d9f5d6805ae4336419050efab3e52.tmp" /SL5="$5021E,6982471,68096,C:\Users\Admin\AppData\Local\Temp\b1bcc65da97e12decb2ab90c48cd09f1262d9f5d6805ae4336419050efab3e52.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD51bb773649fe0db16e6d07d5a9f0bad91
SHA13e49eec6c5257428ae45983a4ec03c23d2ec65a8
SHA256f94c72cc397e33cdfe0c62a481b11b315da95566e1eb935e61ea3def21c009ae
SHA512b2dabd2401c0ea64ab6d0cace365bf28bf40c9de919724710e4e384317532fed3d3780eaf5cb19aa84e0abdb7e8e9dfb31ccf6a86ebfbd64d95c5a7fdd7ff82f
-
Filesize
340KB
MD5eb8d00a26d3b2b1b7384751d142df6ba
SHA1a0d11327c5651d12781f2461f7964e23cfbc5871
SHA256def58c0b86f9826e53bdcaef970b41d30a5ccd65ce6d380f52e16fe39c2db9ae
SHA5129f1371f8b2baaf1570c0b3a69ddc0b69935ac1bcf4ef1ef831f0c60086a9147e9dcacffa32062a3caaba7dac45315d2ad3338cb16206f912f2b32cf25b0af57e
-
Filesize
442KB
MD50b00b82f6f788b20d6019f8ae8b9b384
SHA11d14473d405051b67ccc7d2903ec443892425e3e
SHA256cfb1ec548a2085a64d89ef269a81da3ec861b8a31dc0e8a3af3fff2a7d0bbcef
SHA512ce1710ed60aab39b060634b5a533acac0c3cfd6ab369583f19fa00d0b1a5e4f91c7c7d19ed062e60613b68f4e3e11426aecf8089c157e33bf12d9c95ebf6f607
-
Filesize
57KB
MD5daa8f0c49eeedb2e033f4639eb8f2adb
SHA1034e8c34571d0a90ad2770f008060d7ab4e628dc
SHA2561c704be82ca3a20f35ded437fae7cef4e152ffacccdadf9319497fce139ac49c
SHA512254be354116daac7968a3191c8cf12c02ca54961830f5fc4f59308e4db2c085956c3df3bd8b5c5a8e9beccab09db6cfbc74fed5d041981982bedda54ff534d22
-
Filesize
146KB
MD55ee6dbb99c316040f0d063c20e4a8ea4
SHA1dc5109f5db0d8dbdbd7ff8aff103799d324da3e6
SHA25606daa376a70ee1aa5833dfc204b44d33088b606e5363fb7cafe3cfe28d910e40
SHA51212b0a6083594b4ca420db34d00586ec1657b4464b5df7c81e8021dbb8f72e5afbe5830237794aac867d935c01498d92207b31691fae55fb359f7dfc294d4fdae
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB