Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
11/12/2023, 13:41
General
-
Target
eb3fa309ce604e7da475daaffca40516eda5ac428ff950984e8dac7096471e54.exe
-
Size
6.9MB
-
MD5
45a0d801399caf0925e9e0fdc3c96823
-
SHA1
1b4b8b5db875998407170fecd6551c791c13fde7
-
SHA256
eb3fa309ce604e7da475daaffca40516eda5ac428ff950984e8dac7096471e54
-
SHA512
ca9643a893debe9c720bce0ee157be59ef6a73c850d577d9e6cc8228951e24801aa03f4305bb5e1915594342397587485863f58c0b2405c06e770d69647dde96
-
SSDEEP
196608:QW0fKLtr95HARqIrmVY8S50UL8Kj8yTwHvWY3Nzj:QtO/hAPmVNyEWeNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb3fa309ce604e7da475daaffca40516eda5ac428ff950984e8dac7096471e54.exe"C:\Users\Admin\AppData\Local\Temp\eb3fa309ce604e7da475daaffca40516eda5ac428ff950984e8dac7096471e54.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2J5S4.tmp\eb3fa309ce604e7da475daaffca40516eda5ac428ff950984e8dac7096471e54.tmp"C:\Users\Admin\AppData\Local\Temp\is-2J5S4.tmp\eb3fa309ce604e7da475daaffca40516eda5ac428ff950984e8dac7096471e54.tmp" /SL5="$70204,6973457,68096,C:\Users\Admin\AppData\Local\Temp\eb3fa309ce604e7da475daaffca40516eda5ac428ff950984e8dac7096471e54.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5e87537cdec7c8885d61f0cf1d25e5f3a
SHA10a2f2dda0dc8b4d18de2858de1a21d2dcadbe4da
SHA2568ca7e75cddf79ab4edd8cab4f770733b56e76da3aa948588fb38e52d3b95f701
SHA512e264e2dddf065c46f523fb6b1d5134f6333b20b0f5b53ea5c1aeaaf005ae024f3df6b0197783858ae32d0a5352077d76ce3d7b81f9a34a36123d805d764d78a0
-
Filesize
227KB
MD5d263d41e38dc4433c31b2cd1e1ebf627
SHA13d4cab6c0bc028e1d91531e7212e920d145c969c
SHA256bceb0094d4e02fa96266d5150264a0dc2d9d233d0e4e886c6b112ab1190b2c2b
SHA512c636ff15129314e81e44ad7f3c56359376980c69f22e87f0e83cab31b51f7fb9b3532f40bc5c6ffedce8c404285bf8a7116983cfdff6ad17780bd7cc6ed099e7
-
Filesize
6KB
MD5fe123c6aae5bb6ae91a156a495ff39a0
SHA1c27c713c7c17576860186b154b55cdc935d749ba
SHA2567e715ace0e983fda0e88dc2896747dcceee8e598cca57e100a55b80ecb7eadbf
SHA512509f08d41298c0dfeb92c8c00b1b66c629adb8d438d13b8562adb76b895321ee34862bf096b63d9d1fc671de751e5c01ba5c8298ccc4b94b913829ef502acf5d
-
Filesize
289KB
MD5dd87648509182ae02804bf55fb080e1f
SHA16d21f319ac73d82aa54a0467c3f4daa6036d2362
SHA256ae4ab17cc897986caa382755d37deaa06343952a369fec16ba8ff05cf2a10dea
SHA512fd620a58b88efb1a7fee463e64d5f1c127e109255bb85b4d75938140ad635463eb10f254c805f588fefdc5cb6c6915c1be7bb76e1de116c99b64429144226445
-
Filesize
100KB
MD5c7b30fe5fa955ebd0d3635824ca67b6e
SHA1c403b2fda721cab95aab8a64def7bac18a0999da
SHA256ec8c63d2adfc54e867c24c1c687659e67e3b5d1da419153ac2a05c9ccb41e9a2
SHA512db6aa444c99e494ea061bf514b7fff7065878c309c9eecf7209a92856894b2cf82f8685d011529ae19a2aafa9eef3cf47e1f5ec168c8f69c53847e4caaadee26
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB