Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 17:01
General
-
Target
81bc8c599617b5b474652840db63d286f0ce401996c8501f390dd16ed43123d4.exe
-
Size
7.5MB
-
MD5
ed77f5c6ca5149d6f9ff6ab2ef3d1ec3
-
SHA1
1872ede751efa1a8852169d5d894c78c495a3645
-
SHA256
81bc8c599617b5b474652840db63d286f0ce401996c8501f390dd16ed43123d4
-
SHA512
239653f50c100b1c037d0033d7c4daa66be7f0b0bac7fae14f97c043112df0bcc7fd3383081f32489b948d896c76227f1328c00d7dd92443b4154376ac9a87b8
-
SSDEEP
196608:Tq/iLRC0OLkYNew6tjCtD2RQVsBp4UAzj:THC9Lkuew6t2oCO9Azj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81bc8c599617b5b474652840db63d286f0ce401996c8501f390dd16ed43123d4.exe"C:\Users\Admin\AppData\Local\Temp\81bc8c599617b5b474652840db63d286f0ce401996c8501f390dd16ed43123d4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4OO40.tmp\81bc8c599617b5b474652840db63d286f0ce401996c8501f390dd16ed43123d4.tmp"C:\Users\Admin\AppData\Local\Temp\is-4OO40.tmp\81bc8c599617b5b474652840db63d286f0ce401996c8501f390dd16ed43123d4.tmp" /SL5="$70222,7577497,68096,C:\Users\Admin\AppData\Local\Temp\81bc8c599617b5b474652840db63d286f0ce401996c8501f390dd16ed43123d4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD572f959f04f4b91b1249596ce3e06cc2d
SHA1a4750310714462e85fdbb20cde1f1797ad12355a
SHA256453cc5631d49070b0fe0da17e0978f5c322f088b74b9d758f2791caa865db9f9
SHA5125ad6f1db48c2012faa489e2374d0dc427125a4df1d964ba5d6c3bdf68e2651ac874c3cc09ab1b73d652c6c4af93ffd8e3c642d02835fddd4219a3d17dedbe4c9
-
Filesize
181KB
MD57d21500da9e760efb5c82416ec821672
SHA15c73aa75bf09928428b0f737bae563a4c5f655ef
SHA256d62c0a2d5998bb5e7caaf9d976690fa576de3e904e4753229a8bb3492d5b346d
SHA512ea70102908dad7d1e3441bdfbf15aebe4499a936836e093d6320208e304f62c0244cb4819db797209315630700418b071d3215473339b4b9bef32eff20648e99
-
Filesize
94KB
MD540ccca839f6c38e22eadcc5257be9d4c
SHA1cc343d71410e556d4b700e0bec258918bb01d7f2
SHA2564fe094c113f9d18ae0c096fc0654c84609da2e8b626b3d0b1e388bfbaee67f85
SHA512064e15dfe5ce1bebdd8c6d58a8360737e4afc0450f9018a9045c64160b98c00f0433bdcb1c1f0365c5df62a011f342ebede8d4ee72a5321c417c818fab408119
-
Filesize
485KB
MD50b1942732f9357a51312c89dbf8cdfa8
SHA17f2f87c1c509aba590b6bf2530a1a76f5934f7b1
SHA2561b1660518416708a5a52eb5eb7551188e32dd046430cf53cf7d1a40e018a13c5
SHA5125d2d919063e615931e6528c503bd6d3f0936f67a8430fbb925287af0e448488d375ba2b45c9a0983880dab9c9cc1269a82f1f9191d01e89178f831c5c91d394f
-
Filesize
479KB
MD51406112eddb79f8afb443c8004eb57a3
SHA14e71f2ff1be2c4d6ca1eaf065979119c47aa0268
SHA25602f46d320de8dc98e6b210737351a1052df14afb9c0852fdf86f3a71396a340e
SHA512c93f4de7fd93dbe0ffd55dfa1880722f7f9ed20edda2e8c0b23c3542e6671df9c840fe88deb38e8adf3687be30880161e7c8fb1c7fc74c7de4d5894056016587
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB