Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 14:24
General
-
Target
1cb53c37eec531ecc9965ecda636b970b7cc895c597bcee20ac59b99fdf90292.exe
-
Size
6.9MB
-
MD5
52a2795b654173edc71f483925514b4a
-
SHA1
b369626d959fa781d4eb321c139056f2ad1b974b
-
SHA256
1cb53c37eec531ecc9965ecda636b970b7cc895c597bcee20ac59b99fdf90292
-
SHA512
7e10e731438625f3be9beec5695474f3da93055b9ab9b1152a1935b0074aa95ef8db744ef88f8261e004ac9f4151fd4ecc25740252ee0984098e37dba5446f18
-
SSDEEP
196608:bDoG3bFqjpLC0TSMLsn33HR83v9i8l7INzj:bDyNLCWZ2HS9iQ7INzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cb53c37eec531ecc9965ecda636b970b7cc895c597bcee20ac59b99fdf90292.exe"C:\Users\Admin\AppData\Local\Temp\1cb53c37eec531ecc9965ecda636b970b7cc895c597bcee20ac59b99fdf90292.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GSRNL.tmp\1cb53c37eec531ecc9965ecda636b970b7cc895c597bcee20ac59b99fdf90292.tmp"C:\Users\Admin\AppData\Local\Temp\is-GSRNL.tmp\1cb53c37eec531ecc9965ecda636b970b7cc895c597bcee20ac59b99fdf90292.tmp" /SL5="$50068,6971036,68096,C:\Users\Admin\AppData\Local\Temp\1cb53c37eec531ecc9965ecda636b970b7cc895c597bcee20ac59b99fdf90292.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD50c7bc49b6e285ec40f0dee21e8bf9362
SHA14ddacd621841422302af409ec908c986bbc25b32
SHA256120069754584960de1ef0164f475e929ea7e974b3faf12aa965812e693232590
SHA512c0945812d3b5e7b07380c269b231eefa5f1cb8b93532a3090b1a3797823764ed1ad171f2d0932e31dd81435a85a5327a0008994e2873c929b6b4cdfecca88b1d
-
Filesize
188KB
MD5d8691fa49b65c37ed9504b49f7a4a4d1
SHA11e538f0a1e2ea4bb058e4edad214d02ba50780b5
SHA2566d8c540c6c7576d5ee5012616f4c6a538bd6feee2cf32bf10f4ab12fee21a466
SHA512dcca895391dbe6727eb23cee63b466554994e3507536ef9ba36ba556046df3eeb8ecec25fa19c280525e242056005768e57e7e6708a0de638d1f51e32fda70c8
-
Filesize
180KB
MD5cd4b8c585d92b13a152a5a02257e2c5a
SHA11b3d9912ee6d9095a87aef44e676037dc649b21e
SHA256c1ac525e2aadee42099a7383bc3fcb7a5073f42c6c02e52f18ff8a32d57582c9
SHA512a68696a4e7b7e6804ae56aff4dd2089b38415588a25357f261c3913c9068e761fad6b3c36568aa36410147d7a293434f30f7ace979b8a7c8c587e35556bb8f56
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
362KB
MD5e9da105f8162f2646d80f3fd328571c5
SHA1da9cb42e6378193c4f520c10e84128ce4ab5916d
SHA2563050aa3c50e4b5cb23495a28774fb232e1ff23fa8360161b2399e6b01f8c491e
SHA5125791dc37640ebc04d01f3604e125ff5708af37bbb1a8e2f4bdda57f2cb48b0041bfc539e141d5df41d6d0bbb41336f4f28c623de8228be76adc374ff0ff64e28
-
Filesize
339KB
MD50bf1954cd77e04f193b4068bce6bccfa
SHA159ecd1389d153a8cbc1afdeb681ab2d8fae57be2
SHA2567f5642421305b69389bf3b84b42c8324b25c759c48022891713ed3e9d1844e1e
SHA51280aef3a604c2526895c2d87b23cef6e9c36f53e9b0349a5526355dcd6cc962573f9928a854d74402cf185fe7213c380fec7cd5aeff03ca7a2d1ad2b051bc25d8
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB