Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2023, 11:40

General

  • Target

    e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe

  • Size

    6.9MB

  • MD5

    216de506133cc6ec8a9a7e9ca1227cba

  • SHA1

    8db471b7cf9c851b20d62be8ab5effd50fe9a121

  • SHA256

    e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044

  • SHA512

    397331a58516a1798a96d0c64c72a947a0ae3dd1437281c3e22be8d332ad70efec260bf73fd57355cb0cd04f474e358e81b35e3be0cb7c917f088687fa00b61d

  • SSDEEP

    98304:ZzyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:UQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe
    "C:\Users\Admin\AppData\Local\Temp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp" /SL5="$5006C,6985458,68096,C:\Users\Admin\AppData\Local\Temp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Program Files (x86)\WMAFormat\wmaformat.exe
        "C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i
        3⤵
        • Executes dropped EXE
        PID:3628
      • C:\Program Files (x86)\WMAFormat\wmaformat.exe
        "C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s
        3⤵
        • Executes dropped EXE
        PID:3112
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" helpmsg 11
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2204
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:4968
    • C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 11
      1⤵
        PID:1904

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\WMAFormat\wmaformat.exe

        Filesize

        220KB

        MD5

        b95e7f3cc0dc4397250f0dbfd8484301

        SHA1

        dda36150110913d7d0d53efe958bc4c695988720

        SHA256

        b9db8e42b097fcd9b294309adb32b65c442728ec89bbe4a777215e4ead60c6eb

        SHA512

        5ef13363e52dc26d949f6d57ae2e16cee52b79bb6bfbe10bfb26990742ad4f619e70a928edf25e0456068e9ea6247ca769aee008ed8d72614c1d86cf34c2f282

      • C:\Program Files (x86)\WMAFormat\wmaformat.exe

        Filesize

        139KB

        MD5

        419a73adfd5e81fb6adfa3d37b855883

        SHA1

        2b0f89ecdb53c0e86c353147998c6c523eb57b3d

        SHA256

        73aca61563ad7f8c22a8133c6b596e9102f1bef4ebb76f0a6dea90509f9911dd

        SHA512

        48718eb87f84f298ad30df86b756997050b26dcbef3e427e89877583433671ed04a8543b4b2b61a7c162309d43974b83cfd10dfde072eddef009ccd2ec721ca9

      • C:\Program Files (x86)\WMAFormat\wmaformat.exe

        Filesize

        329KB

        MD5

        c21c6db60e298b645ad02d740a519463

        SHA1

        99ef2f41426c4a3d22817b15e1c7362129e9eba3

        SHA256

        5bd944167aa2712045b9d05b2a7aa3dbcde95d1a0b844f655a668f20e2fa4c4f

        SHA512

        57e3e0ab8e5e7445786a0d5c882fa70f0168e6059637c936ea2fe7fad5ac40ed1ccebdc8852f9875ddce961a9c943d59e50c873678426db4b5a7603be7a1706e

      • C:\Users\Admin\AppData\Local\Temp\is-ACOJ0.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • C:\Users\Admin\AppData\Local\Temp\is-ACOJ0.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp

        Filesize

        120KB

        MD5

        38155a3220ca03c5d0eb4d56631cc3b1

        SHA1

        0709fe97410f68c02e67dd41c1354827f3bd5207

        SHA256

        48d2b86de0426a600d1116d9d0b01f4e1b2d5cfbe8e8413a9df0029c39ed594e

        SHA512

        5a7cffdd467c061130116a67fbf0f6d00a936442d7e013f08a7c0572add5f3c0a776529e5976c614da51b89bab390def6ae819fc88bf0b5a2e1ea83f7a3fb112

      • C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp

        Filesize

        41KB

        MD5

        60df3abf4326e6f3f059596270d95416

        SHA1

        abfcf783cf7e0c0ff223760951964260f766a121

        SHA256

        f15969fe20154da943edf8e6a887491fc043479f979e287ce5cf6a51e2d900fa

        SHA512

        ce10c465cb56f870f39eea2d4267b47ba14cac01367399f0a91ac6b55c9a5d4d17de00e44c5c869aa7b38b24031e11fee86928404c421b1e7039df44421f7df4

      • memory/1988-7-0x00000000020F0000-0x00000000020F1000-memory.dmp

        Filesize

        4KB

      • memory/1988-163-0x00000000020F0000-0x00000000020F1000-memory.dmp

        Filesize

        4KB

      • memory/1988-161-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/3112-183-0x0000000000810000-0x00000000008AE000-memory.dmp

        Filesize

        632KB

      • memory/3112-189-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-157-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-209-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-206-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-203-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-199-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-196-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-162-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-193-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-166-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-167-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-170-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-173-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-176-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-178-0x0000000000810000-0x00000000008AE000-memory.dmp

        Filesize

        632KB

      • memory/3112-180-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-190-0x0000000000810000-0x00000000008AE000-memory.dmp

        Filesize

        632KB

      • memory/3112-186-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-159-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3628-155-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3628-154-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3628-151-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3628-152-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4588-2-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/4588-0-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/4588-160-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB