Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11-12-2023 15:54
General
-
Target
be9aac0ae0444a57a24e8e970e35b793d6a1d701d7050a823f1f779c87a29755.exe
-
Size
6.9MB
-
MD5
f6c73e0d511ebe8090145d588521fcba
-
SHA1
bc9aabed79473015e490fe56f8682892f0667c67
-
SHA256
be9aac0ae0444a57a24e8e970e35b793d6a1d701d7050a823f1f779c87a29755
-
SHA512
7792dc45d39b288ae1428021769d96805a2801d087dd3fa7a5665b50dfb91aa854d37c24df8bd39e2b8e6caca169f15afdcb831e6d7eec934b0ddef5f113dd83
-
SSDEEP
196608:MeusL5Sg97UrK5EvfjuiKsrGugWn7juD9k3Ozj:HVsg95KnxLrGufn765k+zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be9aac0ae0444a57a24e8e970e35b793d6a1d701d7050a823f1f779c87a29755.exe"C:\Users\Admin\AppData\Local\Temp\be9aac0ae0444a57a24e8e970e35b793d6a1d701d7050a823f1f779c87a29755.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2VM2U.tmp\be9aac0ae0444a57a24e8e970e35b793d6a1d701d7050a823f1f779c87a29755.tmp"C:\Users\Admin\AppData\Local\Temp\is-2VM2U.tmp\be9aac0ae0444a57a24e8e970e35b793d6a1d701d7050a823f1f779c87a29755.tmp" /SL5="$80202,6944675,68096,C:\Users\Admin\AppData\Local\Temp\be9aac0ae0444a57a24e8e970e35b793d6a1d701d7050a823f1f779c87a29755.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD59c17731b5b3ecb9c5922c1078c440809
SHA1a76f9d7fca5cc91d8e9c33a8044485d6fed1777b
SHA25665d420edded774eab0f819d8882d2d2eac543095c30f4df2b7fd38b172bc6c82
SHA512df7025cc2fb8df9dc113594195a129c9e23f42fdc08e1d51b8ac64fc0e7dd4b2df8b1b8b6f44963c79535311428086b8b4d3cb1e0ed75f8303d084d8b67a05b8
-
Filesize
192KB
MD538c20d42398eadb23eaa6e53477a8144
SHA141e4361cc19a138da4a1ed1b903a45eb4026eded
SHA25615af343a64bce4227045a30722a54d6d68061546cea82e933a023d298e663cda
SHA5126657bf728f41f2342899207c3a958b3242d47345c38c2cecff43b8638a4d45325bca5f404eecd62d442dc3a0ad31a6044018e5b3bb24dd5a7a0cc4550041c83b
-
Filesize
106KB
MD536383f4938167a6079f35401d03ea470
SHA1d18d15d46af9b621fa5e8ba0de7a5c40059f9f41
SHA256b9e7d7de68c838f9af444bd0bb3157d5e2f4631b243916176fc9249b048bdabb
SHA512848fe0d2deca5e4bb071a2419998feee2188b11ac92347f6d2219375952d8cf24984b80dd7527fd3a6f73ddde73dd9cc163c17629b9d379a5469eb204ca42016
-
Filesize
262KB
MD598dfeff7e5635db13e252964a1d1ee61
SHA1fcc4534ff14bcafbcc36e0926c7633d1fc65e40f
SHA256681c410ad720b0bba213494255591a066e12d90ddd158be752c5b843adadd301
SHA5124439ab8af604b21cc28f739932bfe7ca8254ab84909eb8af55cc8d2f5359d931186aa41f8735f6100a835cda5ed5ab7e1e6a5d5b974c73f055105d69b806f774
-
Filesize
171KB
MD50f31b2bb4fc93e052d2fc944c68c9816
SHA1d4b09e85f2b53779623755c68add1c8dc4a6f29a
SHA2562792a9713ae0e110b356cb4bfdab2a7ddf22de3957805f3f7a3cd435f9a8f956
SHA5126acf6266dd2f9fdb2c665ac43ae0cf69c048363299a8d086f57a7495c4cc647e51edbd71e8ba504466d36426d710c0911576e75b6ce2a1f95b14bef008b1d67d
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB