Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
12/12/2023, 14:11
General
-
Target
tuc5.exe
-
Size
7.2MB
-
MD5
f7222495bc54082eb251c72ea2412004
-
SHA1
a6d57024f0fae798a4963f5b5de7a928cb9f937d
-
SHA256
afcfb89537e80a7d09cd0ab6159ffca3ebb3050cd1f0266aeeea65dab87ccd77
-
SHA512
0357dec568ba6e99410388847111e6c276f0af66afd3e8a4fb26d7bd2bfe47bdbabe51039ec887dcd3945a12bec9f368a3bea947e81eb54586a8eef22f451bff
-
SSDEEP
196608:Mxm5MctdEEAJTpMEa66Ey+/xwAB04awWOAQwlCkzj:qcjEEAJWEh65C30GW9lCkzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc5.exe"C:\Users\Admin\AppData\Local\Temp\tuc5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GKLQF.tmp\tuc5.tmp"C:\Users\Admin\AppData\Local\Temp\is-GKLQF.tmp\tuc5.tmp" /SL5="$4020A,7269570,121856,C:\Users\Admin\AppData\Local\Temp\tuc5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 123⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 124⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5d514f632e44c6cecb042832710e0cddf
SHA168365210b1a463f602e6ce056d46842b1ad8eca2
SHA2562e6de60d963ffa17d069ed959700c124c2076cced04e8010b9ca5d78559e36dc
SHA5120b715479d833d67054b9b95ae61fccd2429ac0582bb21924c0adce34a7c813cbf2df213f4f966674c44a54eec554e1e585faebd966fba6e5f15ba126620c01ab
-
Filesize
1.1MB
MD50b8a6a76d103a7c91d1559c60cbec260
SHA13fa7c624fe5135941bc8b942121773b6d1350b78
SHA256b6fd0460fb7637d51fc7d557b41c0addd12527be46fc2c39e9ea13a7e39bc504
SHA5129d135b56842bae08c44d785a1e55d0b035dfc8491ad6178eed9c82fcc9bdc41814ed1a8e1b0dcfb831c61e02daf33f1ef41e69964cb586e14105d09d8ff6dc30
-
Filesize
791KB
MD5ad72e315cbe7425d4fae3d86309f6561
SHA1796c7aad530c7039a965599c65a231b88be71bfd
SHA2561001e6034e3f9d1445814d6fef835747e448ba0e117f145bd1902f9524915f9d
SHA512842e58b785308cf790c2547afa58b38c1bff0653acd8f6c32024f5c898775861eb289e9d0a00123fbf32a585cde5d0b513cdf045b4432a3cfedf2f0ac9cdfb18
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
419KB
MD5b3c21e3acd830f388635ea4ede16f2e9
SHA16b8c3d31a99e88d289513f10f927ef521f8d2647
SHA2562bd7f3b7fe6d1099b94be6334922a142b0b3d7aa7a090dfcd61932e66098f9fc
SHA512d4e5741eed87aa94c65039b7839e7b79be5cf736632ade7c386d335718ae8b5357e7223ad78b88e93356223b7860cc1e6f99cf56d1e22050bb80b9b2d483ed4e
-
Filesize
295KB
MD553e9e12f6691c8d8e103a8d88742b4e6
SHA1b5b48fe2f7b97feddbf1a29b295e4585f300973f
SHA256ccfdccda493a496bd286c6ea21a72972360dc24c41805c08503eac64db8809a1
SHA512fd407ac83edf342a19937771b0683350c2c53ab282f2e03a46d995f28b66f973674f70380254a7514fbe9dcdcbb43cedf031258408db35a70813c4d400a6975b
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB