Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 14:58
General
-
Target
tuc3.exe
-
Size
6.9MB
-
MD5
59634bdf3c25c0b48d2623288ef47ecc
-
SHA1
2610ba8246fdaa1795d6b90e4132350a783f2271
-
SHA256
7deabd4d922c9c04d4fbe04ea5a59f5eb2902f5a80c4ef96388ceab2bb053c91
-
SHA512
cb9c3c451d4895207f9acd4b5c8423f3bfd1fe7904dcaa2018884da09be0c6b7944212b7285ab5438b2ac70e3506d59705546fdad638c32d7337327bcd92d566
-
SSDEEP
196608:vW0fKLtr95HARqIrmVY8S50UL8Kj8yTwHvWY3Nzj:vtO/hAPmVNyEWeNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc3.exe"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9AB3V.tmp\tuc3.tmp"C:\Users\Admin\AppData\Local\Temp\is-9AB3V.tmp\tuc3.tmp" /SL5="$80068,6973457,68096,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
800KB
MD58b2e0611bfcab302a01c97d10a435131
SHA1fa964e13e094a664438e71c452d9a761f5f00162
SHA2565a4016ae5766deff33418c1d52a0daca261e1cb2d3d8fda80e790986da815687
SHA5124cd3269c329da8532bc5158c565f8c61cf4f15d731ae32437ca4e43953e466f818901398d590fde5f9b6e65c70207bb410ea4141cc6f21769d25489501f5596e
-
Filesize
814KB
MD5a3b5cc4a35eaa6f42cccde036d8ccae4
SHA10f3a6d21210603e33dfac7609fe7b885441ab343
SHA256d6beff2acd3dc7cf213f2955cb3e3375e816a34f203fd0b0d583b555dc5850d5
SHA512e46b9fc75a4eeb6e816e23f323cb4c463d8e884675e8f41c94bd63f4fb49464be7b12d395a36152e41962bfd3581ed7a7bce8a111b9dde1a7014b7aa604937c8
-
Filesize
551KB
MD5aa267792766a13de0928b38e8a5942c3
SHA1a440f59185db1adf373cb6349986776faf7855cc
SHA25689c00f324e1dc78e70b10f0a1b9fb3d50a1b6a97e95b942620e1fa00d3b64649
SHA512032d009145ea98c66a56821ce34397dfd6c3ad37758b9c9cb20e6f347eef4e44df39bc8a519050514c7188dc12245396d923b6e79a1e41205a8b2e8ed759a59c
-
Filesize
672KB
MD5371563cd67a97034448d0ce0a0f7961f
SHA13a6b409ba5aa4da2252448097ae99875027cd591
SHA256f15b6421cf14efbb37743e555839ced4c5108d02f639808596ad78b88f3dba2f
SHA5129699379a5bc7574ea66875d51d95ea3ac61306793fea71478d53fdb2d44c5f7c46088f5854583dd8f65fd6feb736e91447214a2bbeb7ed96739fa61c13f82293
-
Filesize
200KB
MD5224ed3717b4329b59878eb2ce9627c21
SHA1e227fbecd3db15f437617326764029dceee18ef5
SHA25617191b524f96ca3c0a2c46b38bc098f3b68686db878a8b0ceace4c54a0e5d0eb
SHA51264b5c253bcdc419dc1927f7d961a89a5d2a6ae7905365c49b90c84b30da0969680236da5c46faad93d8a988cedb5c26276318c0c3184840c4e8b2ea008282d92
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB