Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11-12-2023 19:02
General
-
Target
4d42e0d3f81d28d04f69a9cfcf91b8426e460a3bbf31c8b51b8e02f750d23c59.exe
-
Size
7.5MB
-
MD5
c72cc64cea266577faf259e582549e13
-
SHA1
70b2d7d11764890dfcc55f84523c63e867b34323
-
SHA256
4d42e0d3f81d28d04f69a9cfcf91b8426e460a3bbf31c8b51b8e02f750d23c59
-
SHA512
596a7a2afcf65cd43629a50e3233016bde226dfeef6a5103866ee18b9676cc6104f409f84ec0ac4794e2d09d0149f054277a715c168519382b0fc6d0ba249fdf
-
SSDEEP
196608:IWc5A2XV/1qTZGgnkphp0rAwZYGespRHDfY5cdV4qCzj:0DFyOTpBsLp1c5SV4qCzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d42e0d3f81d28d04f69a9cfcf91b8426e460a3bbf31c8b51b8e02f750d23c59.exe"C:\Users\Admin\AppData\Local\Temp\4d42e0d3f81d28d04f69a9cfcf91b8426e460a3bbf31c8b51b8e02f750d23c59.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MN19B.tmp\4d42e0d3f81d28d04f69a9cfcf91b8426e460a3bbf31c8b51b8e02f750d23c59.tmp"C:\Users\Admin\AppData\Local\Temp\is-MN19B.tmp\4d42e0d3f81d28d04f69a9cfcf91b8426e460a3bbf31c8b51b8e02f750d23c59.tmp" /SL5="$8014C,7612629,68096,C:\Users\Admin\AppData\Local\Temp\4d42e0d3f81d28d04f69a9cfcf91b8426e460a3bbf31c8b51b8e02f750d23c59.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
241KB
MD5f556df6704e6f7e8c441a0108365916f
SHA1c11e0b8c9841d358cc190f26603d0e8e1f809427
SHA256c7a0261389f31dcbf7cc3d65ef3d46ec903f11bad8f7274245ad4399e0654798
SHA51210176dde986fdaa1271b5f9d1752f72305d8a053897599263f962d1f5ceb7f8d14d095cf8cbaf8471877f6977eeefd6404eb7865e210ccd6eb5b29d5d0036121
-
Filesize
78KB
MD56411fe52b6f1cd4f0f648019364d5b56
SHA121eb06d30335b12cd1f594b88049d7b10e5fbe81
SHA256e7a52121fa3ad84020dbd84966bd24e4c15f74eb3f29f5c607a5d3a4821c9e56
SHA512bcc50c44bc8e7e08c3183edd14339ec83bc954596ab8a1b17f64ff0056980440347c8e4a47b2309054a9a61481e306dc6b2d05e12610ae9151ba5936e4a67d5f
-
Filesize
167KB
MD564fd42a9e16f7543b3a3e58a44772f43
SHA1b02c9387b687fd54f4fc315fc07fbb00d5d5c81b
SHA2569dc06f071c5bdafa77d0a79df07da31fc8f00bf9b082bf65a290dc83097f9535
SHA512d8299f620c6eda72ed533180b01368c5d887941a671cd084330286fd5b6a8ab032ae5fb758cbb0355c161cdb667630bf1c213af25188baff30167447febbae9d
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
79KB
MD575bb12e569871e45c859dc327387cc18
SHA1d872fb2ef76ffc955524954ad6b89ab0eb46b0c2
SHA25698d0f3524c3a8c27b2bdb23f957f1dd326c239b17e253b7f29d4104224a4cb8c
SHA5122726eb440a5e530d975819adfb28ea06c1c9fd6c6e334e6ed3faaba0cc10400a117affdd41ce750b723d14f012f548e586463ab12c58126f40c2869e88089843
-
Filesize
38KB
MD5767a7f543d433693a7898069fcda7839
SHA1cabac5ab8bbc94b29d1186f97deeceeb954efd5a
SHA2562b96db452031ae5c2626d797a1a2d1e4dd797d129c1c7b0393e7bd1650bfcac7
SHA5124a707fffce62e864840df41a41c185e70109c81b40d7a3ab21f4bc1a87b06e1327f6787e1336a5f6fd95097ebc6db66ee4aba607b5cd03c719ea587638b94a4a
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB