Analysis
-
max time kernel
1s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
-
submitted
11-12-2023 10:42
General
-
Target
9a45b74030db722c15639dba46c77000d96779a49b935e72153498206ef719b6.exe
-
Size
6.9MB
-
MD5
7b0e205196f6f874f3fac6ad6b87b5bd
-
SHA1
2786469249c071ae8a9fb0e963f172ac06af5595
-
SHA256
9a45b74030db722c15639dba46c77000d96779a49b935e72153498206ef719b6
-
SHA512
055cadcda5bae0f130854e5561fb2c611cdf6be7b0fc314a22bd2c6ce175d66d513cefbd5f1970a2584809b4cdfa27ea4f5314e1176001d1cb53eb9304263e37
-
SSDEEP
196608:YRW8Bq+q3WGhRQY914E1DF+V3bm/LCGNq3eUeKP3gdVfzj:YQeqbhPK4DFY4CtOUYVfzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a45b74030db722c15639dba46c77000d96779a49b935e72153498206ef719b6.exe"C:\Users\Admin\AppData\Local\Temp\9a45b74030db722c15639dba46c77000d96779a49b935e72153498206ef719b6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EDN7J.tmp\9a45b74030db722c15639dba46c77000d96779a49b935e72153498206ef719b6.tmp"C:\Users\Admin\AppData\Local\Temp\is-EDN7J.tmp\9a45b74030db722c15639dba46c77000d96779a49b935e72153498206ef719b6.tmp" /SL5="$60070,6953145,68096,C:\Users\Admin\AppData\Local\Temp\9a45b74030db722c15639dba46c77000d96779a49b935e72153498206ef719b6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD54bebaf1701090617aa1940d5144b6f6e
SHA18c25f5a87358f344ad60039594e3230ea2168cdc
SHA2562bf133435975eae240474cbc2935983140e2d141e2c2adbbb05310626e696f60
SHA51237029509c3e8eb0ddfd94bbb90554957182db2fa351dc9f57a022bf14bdc531af3178e3c37ead3f9c4f0b944e1190ab06bcb0a2c4ec15d76d33bd8cc08915593
-
Filesize
14KB
MD544ca34694119b6d781b5669ff46509d9
SHA16cb2ec95194538d7ca6df1f7d37c5d529cc6e0c4
SHA2564d7a1381baf5cb229c9f65bd8676c0db18492c56ea270bfb75ae4f88508c7707
SHA512020c295bfeb84859fdef03635181bc37becba4ea73f55bfdb2d1eacea63087995b774ffb8caf5f7ce894b57e1bcef3701989540f5675d0ebdd802e5503ab2fb4
-
Filesize
56KB
MD52b8bf8aab2a0ec4781651e4aab9a25e4
SHA17a443bf81d7a87d6cc5ff9a6167106c847835f62
SHA256a0b708219abcd12c24a1cf3a3a14e49ff4ec5dfe54ccd5d58bd08b52a68f71ef
SHA51269716bb924f3f6af86b34df3c5690874e46851485d5aa90efac632af3fba53410cf2730d0066f2f15265bc48b43905d5d650efb913c0d8ce1a87561172bb54c4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
5KB
MD5a4feed0f449b83e3585b8c89c9b6ea7a
SHA1b1eadc7ae9a6c910d60e9772c9e4b7401f6b9e02
SHA256af874309c6e30ee2fe75a2d135b69a4b526d42db3a50115c95ce2ff6f669d456
SHA5129b51102898d5aac1209ae3203a3d9257a0cc271f52b04c112028371dde66414af785a83e85d527cf45c3effe38befa474340ed6373bc707024432abf91b2c647
-
Filesize
92KB
MD5e23c9ecf69cf8a0d5273f50a61d4c7f1
SHA1add1a0b47b0dcd57fe397abba8a8375478868823
SHA256a1e35c79dcc6d1f50638437e6a36c24a7580a2c293c21c5248cda2b72efc8e3b
SHA512f858e2bef4ea1af4668df5698ddd11d75bde85ff57c24fe009152998fed3a62f47311ba772b1eae3862cb4f54a5f19603dacc75d9e145078dc5f6806608c0720
-
Filesize
71KB
MD5ccda9a5290edae077e60c8317125a720
SHA1b59811e9fcec9ce486b5687e1679b36c36417384
SHA2567e4105a773def16dadcb1ba84747883047b5cd5ef8adb163439e0c26993b137a
SHA51298df18493baf3b1e81600e0eaa04421d481f76861261900a827782701912d0aab7856b2f4ef6dc315791966639250477ceb18b83cf9452cd9358bb25555d0007
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB