Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 16:14
General
-
Target
2e926f9a0e5b08f8320f1e7c1f8b418297f9bd112a8f9e383f4e96318bc773c6.exe
-
Size
7.5MB
-
MD5
4247895ac215ce72d0125e3bc20d90cf
-
SHA1
525a12923362e6c6285fc4c9d177accdc9d5e81b
-
SHA256
2e926f9a0e5b08f8320f1e7c1f8b418297f9bd112a8f9e383f4e96318bc773c6
-
SHA512
a24cea53cf16e41e7fbf6a4437ff58117f21c326fce8ca1a99390d74d659036a55931247f46538e91c107c12bc4f5cd7f4d8aceb26119958289f5e639be00db6
-
SSDEEP
196608:4q/iLRC0OLkYNew6tjCtD2RQVsBp4UAzj:4HC9Lkuew6t2oCO9Azj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e926f9a0e5b08f8320f1e7c1f8b418297f9bd112a8f9e383f4e96318bc773c6.exe"C:\Users\Admin\AppData\Local\Temp\2e926f9a0e5b08f8320f1e7c1f8b418297f9bd112a8f9e383f4e96318bc773c6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JKC3K.tmp\2e926f9a0e5b08f8320f1e7c1f8b418297f9bd112a8f9e383f4e96318bc773c6.tmp"C:\Users\Admin\AppData\Local\Temp\is-JKC3K.tmp\2e926f9a0e5b08f8320f1e7c1f8b418297f9bd112a8f9e383f4e96318bc773c6.tmp" /SL5="$90202,7577497,68096,C:\Users\Admin\AppData\Local\Temp\2e926f9a0e5b08f8320f1e7c1f8b418297f9bd112a8f9e383f4e96318bc773c6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD58e087ae5acbe30272e87ba1ccc376b0a
SHA1ca346c4fe9fd457d4f00d3e3d0eaa6102941ba03
SHA25626c690e64c9614783adbf9fdbaf5d4ac406b9ba58e574887565a05806added1f
SHA512944fabc52a6c30a2ced3e4a4de7c8eb7333cd8675be143a5423c343feda4609d267ebe11e9124bd87ef57f4895251696dc88efc7b4d6d6460888344cdc975aba
-
Filesize
850KB
MD5b9fa62649754e6cc9a9621d765cb4415
SHA14c4843bfa0a6c6f2b4e55802cd94e26a97bbb0a5
SHA256b74c0021a8774829f37185c5310ef5f4b44f17a0ffd3a15872425a8fc13ce7f1
SHA512880afc071f9f3332eb87b005e6915944e13549670556e1263e3a2088e41a9cd494d94b8fd1847f54164c00f8b1a55bf1a5d6cd9181a8daff1742535b5ba162d7
-
Filesize
554KB
MD526d73e30419dbac7037d3dacfe8cae3b
SHA1a2e11b9de34fcf62ba4bcb48dace9961f2cc7929
SHA256dcebf7cbdae27f6f4d707bb566aacfdbddcb5ffe8b1e311cc70abd4a76bffaa2
SHA5123944ccf2a1e625c89d37aee53ceeedb293097b393ee101aaf43c14cf308517ede6b141044a8108892a23951800e2661f7368695c73467fe912917f11f3893b81
-
Filesize
190KB
MD5028f91dc2241bdffc972fa8271dd5e3c
SHA1446c5a5f731bdb01423d3fba1bb949a970d9c484
SHA256c68e111fad04bc311c7259eb7e95f6d9d10094a79aaaa5720baed4d593ee1bcf
SHA512803ced1af0d80ab3f5507adc5772b02c23b893b18c186437631db102f33aab226fbe958bba640f4773db343286266c9bf4ce498da92999d060ef7dd497f5b36c
-
Filesize
138KB
MD519eb402246da4da9739f05e7f04df2e2
SHA1f89ea1b7d36a8bf5ae0d044bcb1b8ea5935b8e12
SHA256285e9f9c3e4dec9e838dbc2bc9cf106aa2b8cb0d507d4d062c58efd3cfcd8c0d
SHA512b973da334e5ea909fb442675b162cc9579d65a2bc9435ef8d774f3febcdd159330fe8ba9b2f493cfaf8c6d19777881097a3be3f2a56973fdc92e464774ec785e
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB