Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-en
  • resource tags

    arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/12/2023, 07:41

General

  • Target

    c7a68762a72cd162b6e4d4c4d3e48bd8668142a765d391009f04704d3fe83ad3.exe

  • Size

    7.7MB

  • MD5

    36da2cceff61f1824827affb3a599886

  • SHA1

    a6f00b01272a45d5c84bf81126d1b53343e831c6

  • SHA256

    c7a68762a72cd162b6e4d4c4d3e48bd8668142a765d391009f04704d3fe83ad3

  • SHA512

    f65c951c1abeadbade3ccebda37f3e9611bc5c6837ed9b80b5f46ae1211d5770aefeb00e613cc6894cfc0819dcfec5e07e416c306f177ac4220ea5717e031003

  • SSDEEP

    196608:txm5ZY+LWEHHi/a055Uu5gLAj1DMWIuxurIfDnzj:kYKWEUl5JiAj1DMqumjzj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7a68762a72cd162b6e4d4c4d3e48bd8668142a765d391009f04704d3fe83ad3.exe
    "C:\Users\Admin\AppData\Local\Temp\c7a68762a72cd162b6e4d4c4d3e48bd8668142a765d391009f04704d3fe83ad3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Users\Admin\AppData\Local\Temp\is-C5TGC.tmp\c7a68762a72cd162b6e4d4c4d3e48bd8668142a765d391009f04704d3fe83ad3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-C5TGC.tmp\c7a68762a72cd162b6e4d4c4d3e48bd8668142a765d391009f04704d3fe83ad3.tmp" /SL5="$701EA,7808387,121856,C:\Users\Admin\AppData\Local\Temp\c7a68762a72cd162b6e4d4c4d3e48bd8668142a765d391009f04704d3fe83ad3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:4512
        • C:\Program Files (x86)\GIFMount\gifmon.exe
          "C:\Program Files (x86)\GIFMount\gifmon.exe" -i
          3⤵
          • Executes dropped EXE
          PID:4368
        • C:\Program Files (x86)\GIFMount\gifmon.exe
          "C:\Program Files (x86)\GIFMount\gifmon.exe" -s
          3⤵
          • Executes dropped EXE
          PID:876
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 12
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2196
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 12
            4⤵
              PID:376

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\GIFMount\gifmon.exe

              Filesize

              1.4MB

              MD5

              89fee502af3a6c697c0cbd4bdcf57ef8

              SHA1

              064cb20d0155515d1c80054a2a0dd6c3cb6a1a84

              SHA256

              8d0f1e17e9b43a3ed088dc38291d95493e65399c07e40917557e5f07c6fe1406

              SHA512

              49b88c09477e89f2212c307aafc393164493a94468b961407b3e41a4997e16b577695bbffa3c491fd376a3db2ccfe9791d201db352482fefa0130b659ac8e6b7

            • C:\Program Files (x86)\GIFMount\gifmon.exe

              Filesize

              583KB

              MD5

              c1bab98ee6a5f9d82553a323b27c6f88

              SHA1

              1f2263dacd088b8ccf2c9747c19b1c83e63a079c

              SHA256

              19cf7c0cc7925d10b7f0a09b9b02e35a80677123f23aa8465d0a23101f8ca6d8

              SHA512

              50d2fdd07fe33f9cdcc80e65fb2049ba3953a9a83fe485da8b264b6cca8802fa5144745a561aa10cba30ce663e980a9282d05cdaeda3b4c9616cef272fcf950c

            • C:\Program Files (x86)\GIFMount\gifmon.exe

              Filesize

              23KB

              MD5

              3150821cbc2b45c3ab8dd43213c42553

              SHA1

              2f5d456b478a41309551044322d047e18b1a6a99

              SHA256

              6c624dded9a68005e4bb6c886860c668f127b9434142bd7dd333acee0c6d838d

              SHA512

              2b7bfb4283fd418f593349962ad6ed1aed9cba377790774754a25f650c7241f0185031f7425024d56cc0653df5bc322f2921afeb25ef322a765579dbee8b7f30

            • C:\Users\Admin\AppData\Local\Temp\is-C5TGC.tmp\c7a68762a72cd162b6e4d4c4d3e48bd8668142a765d391009f04704d3fe83ad3.tmp

              Filesize

              687KB

              MD5

              f448d7f4b76e5c9c3a4eaff16a8b9b73

              SHA1

              31808f1ffa84c954376975b7cdb0007e6b762488

              SHA256

              7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

              SHA512

              f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

            • \Users\Admin\AppData\Local\Temp\is-AIDO0.tmp\_isetup\_iscrypt.dll

              Filesize

              2KB

              MD5

              a69559718ab506675e907fe49deb71e9

              SHA1

              bc8f404ffdb1960b50c12ff9413c893b56f2e36f

              SHA256

              2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

              SHA512

              e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

            • \Users\Admin\AppData\Local\Temp\is-AIDO0.tmp\_isetup\_isdecmp.dll

              Filesize

              19KB

              MD5

              3adaa386b671c2df3bae5b39dc093008

              SHA1

              067cf95fbdb922d81db58432c46930f86d23dded

              SHA256

              71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

              SHA512

              bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

            • memory/876-157-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-160-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-199-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-196-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-193-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-205-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-183-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-190-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-187-0x0000000000960000-0x00000000009FE000-memory.dmp

              Filesize

              632KB

            • memory/876-202-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-186-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-164-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-165-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-168-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-171-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-174-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-177-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/876-178-0x0000000000960000-0x00000000009FE000-memory.dmp

              Filesize

              632KB

            • memory/1412-161-0x0000000000650000-0x0000000000651000-memory.dmp

              Filesize

              4KB

            • memory/1412-159-0x0000000000400000-0x00000000004BC000-memory.dmp

              Filesize

              752KB

            • memory/1412-11-0x0000000000650000-0x0000000000651000-memory.dmp

              Filesize

              4KB

            • memory/1444-0-0x0000000000400000-0x0000000000425000-memory.dmp

              Filesize

              148KB

            • memory/1444-158-0x0000000000400000-0x0000000000425000-memory.dmp

              Filesize

              148KB

            • memory/4368-153-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/4368-154-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/4368-151-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB

            • memory/4368-150-0x0000000000400000-0x000000000069A000-memory.dmp

              Filesize

              2.6MB