Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11-12-2023 10:47
General
-
Target
fb175c6e25e693ab0a9819b6e1e11dad8e878196d15ec68e581712ea7977d6ee.exe
-
Size
6.9MB
-
MD5
8496ee46c72f7146459083081a33eca3
-
SHA1
5041fbd31aa51e0808a51e8acb15fb1c1ebbe22e
-
SHA256
fb175c6e25e693ab0a9819b6e1e11dad8e878196d15ec68e581712ea7977d6ee
-
SHA512
4053c3867aab27e3418419ec5376667ea1e1a778d13003412bbba32061b7449b9dce08b9e87e32e264d06c56168b55bd5f9816bd689e26ecaffa7dea783847bd
-
SSDEEP
196608:4yD4UUAnfcrSuleVp+jatZRGrrC/sF5wvACzj:v4Uvfc2RGatZcXF5uzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb175c6e25e693ab0a9819b6e1e11dad8e878196d15ec68e581712ea7977d6ee.exe"C:\Users\Admin\AppData\Local\Temp\fb175c6e25e693ab0a9819b6e1e11dad8e878196d15ec68e581712ea7977d6ee.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JFNT7.tmp\fb175c6e25e693ab0a9819b6e1e11dad8e878196d15ec68e581712ea7977d6ee.tmp"C:\Users\Admin\AppData\Local\Temp\is-JFNT7.tmp\fb175c6e25e693ab0a9819b6e1e11dad8e878196d15ec68e581712ea7977d6ee.tmp" /SL5="$B006A,6986290,68096,C:\Users\Admin\AppData\Local\Temp\fb175c6e25e693ab0a9819b6e1e11dad8e878196d15ec68e581712ea7977d6ee.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
521KB
MD5d612d258014b55d619ef61405b5498ce
SHA1df1a01ed893702efb377e9de0c47707eadbe563c
SHA2560cd726e798dede0c3327e5a4fbff61807b01fecc8b7cf841b4be110733620484
SHA5121ba9c5cbfb359707b99b053f35154399eb5bf77d68c6f111843971c996e16ec365e00da536f0431bc996e41b21b53186c5da360c3e6bfd5905f4e164f25f4419
-
Filesize
548KB
MD51f40ed4d4554b9173280bf427afd7e39
SHA1a80eeb692a70f54270183a186c7336552887afad
SHA2565897ad3d09181f9bcbc89a9aaa24ff2d840ed89e33e8adf246fda37e58a36bb6
SHA51212da983838f8e1374f99beb42d56a85482e9b32b1368127c7f3337dc11dc0ae31f5464e20aa09c7ab0a16a0ef400aac5ce8ce2c6b19ffcb2a0064f6bb3a23217
-
Filesize
453KB
MD5cce58c2783816de19a43f92fc745ed7a
SHA1682732a560e0f91e54982cd01e1f996a87ba493d
SHA2562ef9c5f161f9f636816f8c9dac6c3e2dd9a388ecf8f09487c8154df5e18fb0a3
SHA5125314e6366f40364dba417f909654e57f7ea2d888c41826b668a90aa849d5403b2ce220aae51ca3f13ccd6e27398264f03d4e5afe4fd523105ae0fa156cc7c8e9
-
Filesize
91KB
MD5a00336b5dcadff860742f82bc647488a
SHA1a93d3377776488e417b98facf0bd3a147f2633d5
SHA256876dc382bd5af4cfd51d149e892ab300cdc2a4d940235b1da6ea50836bcd7c56
SHA51265eab4392aef8bf8aa84f16ee1653848f06532a445e04f4c7c15e00c36e3e608ddbd2342bff5172dbdbe2d6e7a7974ce38a6ad708b37efa99d1d7bda973bad19
-
Filesize
113KB
MD56f3d09a11b6efe62253504f1a888ae2e
SHA184c55414f17ed5557af39f766fb6d72b485a7529
SHA256619cfef3ad90c8e6ac1f91ae433c45ba40a48ebe0675a5ee57ca0205e64874bd
SHA512dadc00c42d4ba5eef3ed62c10a35761f699dfc76cef7382b559a37b2233dd6d1e96d1aad1bcd854b873ba31ec1ee346a5928143f494af9c6e087f53aa04886fe
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB