Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
11/12/2023, 19:04
General
-
Target
tuc5.exe
-
Size
7.5MB
-
MD5
5d2c2f6216fb8ed787d1f3ebe34dea37
-
SHA1
5acabcbf4a6429213854b95bd58ebc5db33c95f2
-
SHA256
5480df9cd132b06451421d27999536b4866a95286f3e28cbdbaba1851d405f34
-
SHA512
92e3685ae00d989475d1136a8079fa2b264353313a8a304b009ca7ae30dfde8574d66a786573c325cf8b111e9deea44ed658336478a97d0517e81ef32b1a9965
-
SSDEEP
196608:3O78pimeIjZMmsj7bXzjl3iT1A9SG7ul2xdVNWiYmJE6RI6zj:+78pimNjMDzjl3dQAdVN1YyRPzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc5.exe"C:\Users\Admin\AppData\Local\Temp\tuc5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L91CC.tmp\tuc5.tmp"C:\Users\Admin\AppData\Local\Temp\is-L91CC.tmp\tuc5.tmp" /SL5="$400F0,7611198,68096,C:\Users\Admin\AppData\Local\Temp\tuc5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5b0eb742fb90db2f1ebbc66cbbfbc29ff
SHA1f4f7e8b9a80a1b8b4e1e7a96a649bddda9577101
SHA256aaad1c3cb8da938164217ee5a916e77d95766c3ed52d0a32b8446decdd0b91f7
SHA512e6d42eeb8d766a5bbc1cd2db27cf2fc46122fdae3be82a757fcdeb95f159021b0c7b41f89776358b2dc6d4c5a3f43dce510d33c687883230288bab1819916745
-
Filesize
41KB
MD5f74378a0102a5be1b137ac15582f3641
SHA15c3c2cfd649c9fa4bf83dc8b06643edd7e9e2314
SHA256f5f29c537370541111468d9e0a1cc9934643e0fec85b5e83c203dd3208cd74ba
SHA51231a6c9c3f55d727b79a064c4d493eaa6662880b94ceaa09c60272107e33d86494ccceda74d435951bc93d07974c43eb056bc3d0e6437a55ceec7bde94483c3c8
-
Filesize
21KB
MD53ad59880034644ba322d23b6f0c6a1b0
SHA13b1c413936f54b30e2025c5a60025487746095af
SHA25603c43e91f110712eaff4749f753c4bdaf9e4b67ae07916d03e8dda4a6c22e03d
SHA51210df88bdfef439f6de5062b84abf6c02d1497418690708b4986433d1e13ca6658ed5bb06daf091ffe168bc859f9a75e0c7bcdbaa22c2db37f822aed28406884e
-
Filesize
687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
16KB
MD5fcc260261b30f0542422b1c3551eb2be
SHA1c20a9462bec917c88a7543709a282853074947df
SHA256eca6f8f17fd22b739529df84a7b8bd7f795930fe966641fc91a9e7ec5b38907a
SHA51223c8f5da03884d23223211de059a658001ac97d72a924356a491209b2950f50a13e555da364121179fb4ceabdb9f8a2e99ddd25276dd2a93752d7e49b61e96d2
-
Filesize
1.2MB
MD5f80a3d82869231854cfc425c190395ed
SHA1c34a3e090b4676dc9e880e3f369c5d0d57cd63c6
SHA256ba6139f955099343733854b796538757d15e47b41debb87eed847a08cf148a2b
SHA512abc66203a01df5ec4d6fc9fe20f3f4f96590019eae5c675d6407715cf26c55e400641f6fcfc597a53971fed67cfa3bdf5d0fd2d13c7d8ac0482d17e5c167313b
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
45KB
MD589fa54616a21ed78122a7d8eed7cf733
SHA1d7343f206fc2f1e41b5375f00a4a0af43dd82a20
SHA256f521f5aac473965224b6d7056de202992be49462865981bd5db502e85cd695a0
SHA512c6dc87d192ab801c67c0b9ff59d0895cedfde59dc75da1d322e9560598b137b53b61bc2512dd0eb0bfc5b1a35d70eb683de3093762005d1fbf849166085d23f5
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB