Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
11/12/2023, 16:17
General
-
Target
tuc3.exe
-
Size
7.6MB
-
MD5
511cd2302f0fe5d87619126aa3de8ef6
-
SHA1
efb34b47412a277a0bb898ee036b2830d66dd102
-
SHA256
db2df2578d7d2c15e5c1696c6dbe2ebc4426beff743c724afb99f0d5b28ed56e
-
SHA512
98b0c36bc3cdc4b08af59c704f3333be99ef405201062c5158b5f36892e5451fe51a475975cf9745fcea77c73b6d13ed5a567559b1eb2a73e640c846d9c472c1
-
SSDEEP
196608:KnnY8NWvGpWTTlm0OxwW+nFnfZsMUdFt30Dzj:KnnY8NELTIrxwlxQWDzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc3.exe"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-M684M.tmp\tuc3.tmp"C:\Users\Admin\AppData\Local\Temp\is-M684M.tmp\tuc3.tmp" /SL5="$4001A,7715663,68096,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222KB
MD5c2881f97172f46f16a8d491855f834f5
SHA1f8fbd3ac5223064265eae50a5136ed5b871ac3ac
SHA256f141d1f3d2da187143dfd1cd6440cd97b3d9f1c04432fac84317f7e261547477
SHA5128744244a12bc62569e6d40d315215e3d55459360679bf0706102fbda3d201595be5f2b9ba158f44919d8b7a4c251494d72dd90c9eccd95bfbd4ac02d40c50e70
-
Filesize
203KB
MD57d49d0d195a9599ac92555d7e3091270
SHA1820ad5988973c87a8f1e5fff0ed9fef65dd8a24c
SHA2561bbc224679ef62f778251e34678d01587470eea6b4e2b57b0254a4944b8a13e9
SHA512dc96ad81557ed8b3d5f432e6abbcfe537a175b196eb697e6bf8f61ccea2ade7b4aebb9240dec4748e067a9a1122a6e7fbde0854a718ac0506724399e8f135721
-
Filesize
203KB
MD5959b9b4ea25d9e5758dfb3bfe4d46ad2
SHA17993c020f134118fe5f4d7f55637dfcbfcd81681
SHA25604def3286c00a9385b646860da46ab0b46e92c74678645ebd586499a5bf2150d
SHA5121242ffb0aea20ed042037815cd93f84820770ca4a5a067e52aff7e1f582ce9c20e07e40f81a52b6947f1128e3342e733baed75a1e90331c6dc81c953b6e01f4d
-
Filesize
665KB
MD5a16dc12003a521dfbce854d73b26a339
SHA1ca20238e0e32b83a267aa8084fa93b42df8cfbf7
SHA2560eb8843f646f7713a9ae1634014b4b2e633cfc4b7547d4b2731c7b6de2713c43
SHA512e0242670be3b2bc7d42afe31ff157e69c36aee48455e5d4e2687c40bfe999d34d397cb5da8060b60004bca3bad9122d77fa2f3813681a69f9e2bbb5bf35331d8
-
Filesize
51KB
MD51a724473c87a30e6ad5f343b17ff7821
SHA1226ce1c2272313dcf25392a252507be70edcaf7f
SHA256022e9008a526b21ed23b3b923f0c4ca79cdbc4216dfae67b2ebd9506aa3a7d57
SHA512d64affb5d5d857ec19df19de45586b01007601a1a579201e2b72ecf6431edd36bd74ce3deec01a846d7610d7128221aef0d64d6fd1ad602b5e6a9b3b8b2097a2
-
Filesize
261KB
MD502ee5afe6f0c368699277f7b2de27af3
SHA11500faa51800d51e7803ee92cd044e0b3dd97be9
SHA2565ffe3134e5964fa26e7286c386976bc208126600628a3719ce49e29eaf56ab5e
SHA512a4acde9a2e92ecb29cdd084715be621b168fa410b6442b2a820e829428e4023320fe4983aaca00866eac0ab28813ec820cc11451e2f0acfbe1960405bac9670b
-
Filesize
303KB
MD5660814d5c3600ab62790e3351918c261
SHA191931b46675346d2833feaa8cdccea47ccb330f8
SHA25680f202760ca2b28a9e487a1e8954ad7c88f09dd1bcb3e1345dbdd4b62badaeda
SHA51299a2104ac5db290d95048645ee69c99fde930c3c8e7e5ba1cafb69002f5fcb9d37952230cc4e3ca5100e3f753814e6fd08a7ea6c17312ae3540a00d5817ca08c
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
512B
MD54bca85420703b590c1346076c1f10841
SHA1126e115e93a522803324089aef432973445f1210
SHA256bf218fb92a27cfe64b6b1ba9b33e34a87d3144499461b6f716cf5a21b82f3b80
SHA51271aeed2b53c87de2b7d1bdf999154c9a8601ee831ca6e160531f6fa5f83228333d3491a6f88a03017976cf3a6bad206d87efbae4e4502e0425f3ba8f68c08056
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
752KB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
2.6MB
-
Filesize
632KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
632KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
632KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB