Analysis

  • max time kernel
    154s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2023, 10:15

General

  • Target

    dc9d0261523e62beb1188473a1604277cd0bc1863f1d3e1d3f83f597e6a79fbb.exe

  • Size

    7.2MB

  • MD5

    948c8497880411cba7e13fdb1a857277

  • SHA1

    b901f0c431e2a8c0406551e28e987379bb0ebbf9

  • SHA256

    dc9d0261523e62beb1188473a1604277cd0bc1863f1d3e1d3f83f597e6a79fbb

  • SHA512

    2241b97187cbfcd4aba93aabbfbc83f4abf453738b3f173134382a68d67d351782ae091c414c53913165139d019c562c8766377282a1879fe16113af0293bf0f

  • SSDEEP

    196608:gxm5xCJOyhaLRyatbRgZIWFhoPd9qRvnTyGofmyq1zj:HcOycyKbf6i+E+P1zj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc9d0261523e62beb1188473a1604277cd0bc1863f1d3e1d3f83f597e6a79fbb.exe
    "C:\Users\Admin\AppData\Local\Temp\dc9d0261523e62beb1188473a1604277cd0bc1863f1d3e1d3f83f597e6a79fbb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Users\Admin\AppData\Local\Temp\is-N77S6.tmp\dc9d0261523e62beb1188473a1604277cd0bc1863f1d3e1d3f83f597e6a79fbb.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-N77S6.tmp\dc9d0261523e62beb1188473a1604277cd0bc1863f1d3e1d3f83f597e6a79fbb.tmp" /SL5="$80066,7250749,121856,C:\Users\Admin\AppData\Local\Temp\dc9d0261523e62beb1188473a1604277cd0bc1863f1d3e1d3f83f597e6a79fbb.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:4684
        • C:\Program Files (x86)\numGIF\numgif.exe
          "C:\Program Files (x86)\numGIF\numgif.exe" -i
          3⤵
          • Executes dropped EXE
          PID:4276
        • C:\Program Files (x86)\numGIF\numgif.exe
          "C:\Program Files (x86)\numGIF\numgif.exe" -s
          3⤵
          • Executes dropped EXE
          PID:3552
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 12
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3120
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 12
            4⤵
              PID:4732

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\numGIF\numgif.exe

              Filesize

              2.1MB

              MD5

              e30c1cf8e70b07a2b5f6b6c91c2f8d12

              SHA1

              c0b8f9f23fdf95658e505880a3dda67f450c7758

              SHA256

              7006b0097203ef9a4e4d8510acf880297265d79c431693821879c41e50c55451

              SHA512

              76f346a9f25aeea95dff27f4182fb37e0142eed8a9f44d185884669944ac66653d4fa805802ab39085f991a70d04ac3e5cfd0937cdeffb8bb703d74d2b418672

            • C:\Users\Admin\AppData\Local\Temp\is-16VF1.tmp\_isetup\_iscrypt.dll

              Filesize

              2KB

              MD5

              a69559718ab506675e907fe49deb71e9

              SHA1

              bc8f404ffdb1960b50c12ff9413c893b56f2e36f

              SHA256

              2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

              SHA512

              e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

            • C:\Users\Admin\AppData\Local\Temp\is-16VF1.tmp\_isetup\_isdecmp.dll

              Filesize

              19KB

              MD5

              3adaa386b671c2df3bae5b39dc093008

              SHA1

              067cf95fbdb922d81db58432c46930f86d23dded

              SHA256

              71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

              SHA512

              bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

            • C:\Users\Admin\AppData\Local\Temp\is-N77S6.tmp\dc9d0261523e62beb1188473a1604277cd0bc1863f1d3e1d3f83f597e6a79fbb.tmp

              Filesize

              687KB

              MD5

              f448d7f4b76e5c9c3a4eaff16a8b9b73

              SHA1

              31808f1ffa84c954376975b7cdb0007e6b762488

              SHA256

              7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

              SHA512

              f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

            • C:\Users\Admin\AppData\Local\Temp\is-N77S6.tmp\dc9d0261523e62beb1188473a1604277cd0bc1863f1d3e1d3f83f597e6a79fbb.tmp

              Filesize

              540KB

              MD5

              323d4b3b51dcf3b38b9e8fb1633c646e

              SHA1

              591ee7ad81a853f5cd9d849d8338acef3c682bb5

              SHA256

              a16396d9615368203716a3e89020161806abf2c5ff0ca6f5c072436f204a32f3

              SHA512

              d676518f3d7598b16fac13163d9d8844f89800c1e3d7bd822c7f12259cce4e6fa40ccd122ea8aa24a044cfb28ba767e47cb1fe4061d9f431d22405610059ac93

            • memory/1176-108-0x0000000000400000-0x0000000000425000-memory.dmp

              Filesize

              148KB

            • memory/1176-0-0x0000000000400000-0x0000000000425000-memory.dmp

              Filesize

              148KB

            • memory/1712-160-0x0000000000400000-0x00000000004BC000-memory.dmp

              Filesize

              752KB

            • memory/1712-6-0x0000000002340000-0x0000000002341000-memory.dmp

              Filesize

              4KB

            • memory/1712-163-0x0000000002340000-0x0000000002341000-memory.dmp

              Filesize

              4KB

            • memory/3552-181-0x0000000000990000-0x0000000000A2E000-memory.dmp

              Filesize

              632KB

            • memory/3552-189-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-158-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-159-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-209-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-162-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-205-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-166-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-167-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-170-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-173-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-176-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-179-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-180-0x0000000000990000-0x0000000000A2E000-memory.dmp

              Filesize

              632KB

            • memory/3552-202-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-186-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-199-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-191-0x0000000000990000-0x0000000000A2E000-memory.dmp

              Filesize

              632KB

            • memory/3552-193-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/3552-196-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/4276-155-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/4276-151-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/4276-152-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB

            • memory/4276-154-0x0000000000400000-0x0000000000628000-memory.dmp

              Filesize

              2.2MB