Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 19:55
General
-
Target
b48378a206ec61a4ba0243f7d02ee878988294b9aaaa9dd61fc1a9b1277a6878.exe
-
Size
7.5MB
-
MD5
d55e2ef39d641022e29a923aaba1f3d1
-
SHA1
959255b801d83d9433139bb7911902e414ffdb03
-
SHA256
b48378a206ec61a4ba0243f7d02ee878988294b9aaaa9dd61fc1a9b1277a6878
-
SHA512
e49607b87f532cc7a9edd255afa31d7121fdd4fc09f9313ce34bb766ea3fd961c9ba22afbdd87498d245895032d2b631dfd96fe208c4983e1f8fa606f84ac166
-
SSDEEP
196608:1Wc5A2XV/1qTZGgnkphp0rAwZYGespRHDfY5cdV4qCzj:5DFyOTpBsLp1c5SV4qCzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b48378a206ec61a4ba0243f7d02ee878988294b9aaaa9dd61fc1a9b1277a6878.exe"C:\Users\Admin\AppData\Local\Temp\b48378a206ec61a4ba0243f7d02ee878988294b9aaaa9dd61fc1a9b1277a6878.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H3H56.tmp\b48378a206ec61a4ba0243f7d02ee878988294b9aaaa9dd61fc1a9b1277a6878.tmp"C:\Users\Admin\AppData\Local\Temp\is-H3H56.tmp\b48378a206ec61a4ba0243f7d02ee878988294b9aaaa9dd61fc1a9b1277a6878.tmp" /SL5="$60192,7612629,68096,C:\Users\Admin\AppData\Local\Temp\b48378a206ec61a4ba0243f7d02ee878988294b9aaaa9dd61fc1a9b1277a6878.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
580KB
MD57e28c98adbfc90065b8f154802b7f42e
SHA12687ed87510c8092f665c0fc78d9b9f5567479a3
SHA256b447392f6f25440e47d62cef2d791f351c929250b6313db0e7914dfc0b18046a
SHA512a1ea26bb295b4abee6a76c785f8022109030095dba4ede8861975a9cd1bab5152b2da720ba1d90fbc86df35ca6b6f5d5d049a81ce839ad927c55267e777341f3
-
Filesize
695KB
MD5ca036281904572dd4ed71fe03a8261f4
SHA180b2a178c9fe51bd67bea773ff0aab89ab24e1a9
SHA25641450e73f7f0e6fa3cc47bdaf90644df9a1cde3e3b69de53e61b93152cff1e81
SHA512d9ca9b66f783c265ad99029d14105a20b18e98525fa5e459bc03c7937382bc55f9625c231bffd7e14ef7bfbc19908d734a6370b1f4706bf4bfe61ac5fda8aa95
-
Filesize
541KB
MD5170d50ad49511053a4bdfa8584480e65
SHA1aa4630ce304963b7178dcf187faf5ea90baad86e
SHA25624bc7ac1c37edc2ccce8239c6aa1d1506dd514c91104141d593761360a9819f5
SHA512c384d8e57516ebae099335f6651297568677c2fa6cc94e2ad281aaf01e8b8386d7a7a230ce1c1ea395a2fce879876b90394c56d6d7311a757df237ea7adc08a0
-
Filesize
144KB
MD5cd176647aa1f58d47114c8cfd29da440
SHA1478445216dffefd4b4097773a4880e58849ee8aa
SHA256dd44ee0f90ad2fac3b413206f0f03fcdc88ab490b3a517a3f2c02d25e5fb9fe9
SHA5125f2080ea209335a491698b2871d57a7a33f6836d6a0540f11fbd0b1e4f9a9b47fb46f4350153f2e9443808bca1b316b858546dd9b836552a4eb86f93a973e4a7
-
Filesize
165KB
MD53d62b3a4d609440e18574e963898878b
SHA1947106c18465142d39b8bc76d7843c4ec812218b
SHA2565973779e6e428b47689d3c12ec0d9b7c35edf7579ba4b305c6f2df1b96d265ce
SHA51242c5da035ac626064309d8dca56d6cafb6d31a132cbed8b7a5fe825e627f1b2d410f7041684d99bb7cce067a1e94e7dd4a3835f548dd69459f2c13199db16c69
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB