Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe
Resource
win10v2004-20231130-en
General
-
Target
e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe
-
Size
6.9MB
-
MD5
216de506133cc6ec8a9a7e9ca1227cba
-
SHA1
8db471b7cf9c851b20d62be8ab5effd50fe9a121
-
SHA256
e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044
-
SHA512
397331a58516a1798a96d0c64c72a947a0ae3dd1437281c3e22be8d332ad70efec260bf73fd57355cb0cd04f474e358e81b35e3be0cb7c917f088687fa00b61d
-
SSDEEP
98304:ZzyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:UQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 3628 wmaformat.exe 3112 wmaformat.exe -
Loads dropped DLL 3 IoCs
pid Process 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\WMAFormat\uninstall\is-O78H5.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-E4ANS.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EL5KU.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EFGFJ.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-7J73B.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-R15O5.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-PAVID.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CD6S7.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-SFV32.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-3TVA3.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-D6DAT.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GO5TT.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\is-8F1UV.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-ATA09.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-OK6LD.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-7UUVS.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-43268.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RSVKF.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VGPL4.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-U1RMB.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File opened for modification C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-972UL.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-L5TUT.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-7HBER.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-Q1RMJ.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-ENML4.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-NDH5K.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-M66JP.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-2KF5C.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RD052.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1I879.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-U8S1J.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-E1QIT.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-3L2L6.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MIPG9.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VV0I3.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-BPQDJ.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\lessmsi\is-QBF5G.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-P61V3.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-6BEDO.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-2H340.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FCR86.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-IH7OA.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VMSAL.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CE524.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File opened for modification C:\Program Files (x86)\WMAFormat\wmaformat.exe e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-55E5F.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FKIGF.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-TMHUG.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-4401Q.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1R91T.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-OR2S5.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-ODTOU.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-J3QP8.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EGRP3.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-I0CHC.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VKPCP.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-0SP07.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9B6PM.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-IPMU6.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-HN09P.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-URLMG.tmp e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4588 wrote to memory of 1988 4588 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe 30 PID 4588 wrote to memory of 1988 4588 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe 30 PID 4588 wrote to memory of 1988 4588 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe 30 PID 1988 wrote to memory of 4968 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 75 PID 1988 wrote to memory of 4968 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 75 PID 1988 wrote to memory of 4968 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 75 PID 1988 wrote to memory of 3628 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 69 PID 1988 wrote to memory of 3628 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 69 PID 1988 wrote to memory of 3628 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 69 PID 1988 wrote to memory of 2204 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 73 PID 1988 wrote to memory of 2204 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 73 PID 1988 wrote to memory of 2204 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 73 PID 1988 wrote to memory of 3112 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 72 PID 1988 wrote to memory of 3112 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 72 PID 1988 wrote to memory of 3112 1988 e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp 72 PID 2204 wrote to memory of 1904 2204 net.exe 71 PID 2204 wrote to memory of 1904 2204 net.exe 71 PID 2204 wrote to memory of 1904 2204 net.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe"C:\Users\Admin\AppData\Local\Temp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp"C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp" /SL5="$5006C,6985458,68096,C:\Users\Admin\AppData\Local\Temp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
PID:3628
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
PID:3112
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:2204
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:4968
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵PID:1904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD5b95e7f3cc0dc4397250f0dbfd8484301
SHA1dda36150110913d7d0d53efe958bc4c695988720
SHA256b9db8e42b097fcd9b294309adb32b65c442728ec89bbe4a777215e4ead60c6eb
SHA5125ef13363e52dc26d949f6d57ae2e16cee52b79bb6bfbe10bfb26990742ad4f619e70a928edf25e0456068e9ea6247ca769aee008ed8d72614c1d86cf34c2f282
-
Filesize
139KB
MD5419a73adfd5e81fb6adfa3d37b855883
SHA12b0f89ecdb53c0e86c353147998c6c523eb57b3d
SHA25673aca61563ad7f8c22a8133c6b596e9102f1bef4ebb76f0a6dea90509f9911dd
SHA51248718eb87f84f298ad30df86b756997050b26dcbef3e427e89877583433671ed04a8543b4b2b61a7c162309d43974b83cfd10dfde072eddef009ccd2ec721ca9
-
Filesize
329KB
MD5c21c6db60e298b645ad02d740a519463
SHA199ef2f41426c4a3d22817b15e1c7362129e9eba3
SHA2565bd944167aa2712045b9d05b2a7aa3dbcde95d1a0b844f655a668f20e2fa4c4f
SHA51257e3e0ab8e5e7445786a0d5c882fa70f0168e6059637c936ea2fe7fad5ac40ed1ccebdc8852f9875ddce961a9c943d59e50c873678426db4b5a7603be7a1706e
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp
Filesize120KB
MD538155a3220ca03c5d0eb4d56631cc3b1
SHA10709fe97410f68c02e67dd41c1354827f3bd5207
SHA25648d2b86de0426a600d1116d9d0b01f4e1b2d5cfbe8e8413a9df0029c39ed594e
SHA5125a7cffdd467c061130116a67fbf0f6d00a936442d7e013f08a7c0572add5f3c0a776529e5976c614da51b89bab390def6ae819fc88bf0b5a2e1ea83f7a3fb112
-
C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp
Filesize41KB
MD560df3abf4326e6f3f059596270d95416
SHA1abfcf783cf7e0c0ff223760951964260f766a121
SHA256f15969fe20154da943edf8e6a887491fc043479f979e287ce5cf6a51e2d900fa
SHA512ce10c465cb56f870f39eea2d4267b47ba14cac01367399f0a91ac6b55c9a5d4d17de00e44c5c869aa7b38b24031e11fee86928404c421b1e7039df44421f7df4