Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
-
submitted
12/12/2023, 15:38
General
-
Target
tuc4.exe
-
Size
7.1MB
-
MD5
dcc8ed90748f7a0362d8225b2fa18d1e
-
SHA1
fe20c471d7a8c9c027e763786ea2eddb8e0c5c8d
-
SHA256
c2cbf29a2107362ff4a65c41b27b205fd73fe40959aa630c25a82954c54781b4
-
SHA512
83523a45e64346625a5092568ff8d20387223c5895b0ef8bf43582f1154ed9fb47a76446fca8a8990f7c27f3b881d1a6d2dd706df4ef36e4d94ce40ec2066610
-
SSDEEP
196608:oxm5D5YUyRe7VvZKwamjGKAVW7R+gSoASGm8PvsLMwzj:uRepZKwaS79SoASGDP0Qwzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc4.exe"C:\Users\Admin\AppData\Local\Temp\tuc4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-36ROT.tmp\tuc4.tmp"C:\Users\Admin\AppData\Local\Temp\is-36ROT.tmp\tuc4.tmp" /SL5="$40150,7235080,121856,C:\Users\Admin\AppData\Local\Temp\tuc4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 123⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 124⤵
-
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -s3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
347KB
MD52f793e0a558f5f66db7d583c7098e82c
SHA10a5c129701de59c369b410a1dd924155b304481a
SHA25621b2497be321a784f729f45336752baab3fad6bd3be137b647da72c79ec070f4
SHA5128c74e1f4c034bdcef0722ac3d7a1134fab0ce0a8df1a7c0e1dd09cc590f3a16781cc3719acc89e08623c595a0ca56bc824f4494c95b2d7dfa1ee4f6531f737a3
-
Filesize
435KB
MD577de425778bbf92c0eff4981a0e0ad1c
SHA1cda523edd720ff94cbe7a80cd1c998bf4ed7d492
SHA2561054cce0db52a61a941687b7325c40b835872001d8a732f65ce21bfd132ca7b8
SHA512c7b5fca5ed7dce3954429281dd68753011ce3d596854267ba557336b7eb0e5601b93fd1f5facc40c369c55c9964798fef059f49d565b62f0cfc75fd632fe228a
-
Filesize
469KB
MD5f92a9937de934fd973e4986f0c478016
SHA1c7c4079dc252af2f71f4b3e2c57e61f92deb64e1
SHA25657c344b7701fe2402299929cb09322ea7dc5bcc38cf7d9be4aa76b600e620ee6
SHA5129924f1361082a683346c5824159229b2a8b38cf6b803db52693e926e02d35cc71a6a8d6fb92e7ec8ceff936152ecb1f12da45ba580abcc6aa79ddb38c546556b
-
Filesize
508KB
MD50b4768c143cfa1bece202d17c175844f
SHA1d49227c0b8b2d746bdc50741aa94efb08e6a8ccc
SHA256760f0469f166bdfaf2d28d9178e2ed7b2fc453d3f7f22940d09e832921d2c04d
SHA5120ada2ae36d36917bfbaefbd69fc40164fdfca37d385c9c179b83e553034643755084635e10cb9211a21b4d35eb1f29b5d676cca2b7c8f90206f569c82b3d8ca3
-
Filesize
481KB
MD5c3f3459f5d82874d611246ad3866f430
SHA12745e019f6c4351530ecf191d7ba96066e0757b3
SHA2561f377678a3ce303a12a196378973798458889495bcd04a6b84d06720cf6a3240
SHA5122d7b7273965bc5996fedda66295b4f794aa6ea05bbbfc7c70eb6c359baa3314d9d7be9ad28ade72f37936955ede70a9ba5e6e2ebdfd5a596306e1c9cee9939d9
-
Filesize
249KB
MD502f0a3be13cc7ae6ab4b5b10a8d3e05f
SHA1f71e916b10f66fdabc4f2516dd8b28aac2ee6510
SHA256e3fcc50d6d71be956ad03c7bd90cc344bde4c0e29bccafe04b8e51a9c6276bc3
SHA5122484a827e152754becc32b4ea923739e37f2bb140cf876091c590d5fa3fd082de9cf7f15b1343994608b86f6db1d91397faeddf510eefe4ba3a07f0992afe192
-
Filesize
187KB
MD52d9c23b8ccd2ccd771f0d1c740be3d31
SHA145f4f6b930810cbc7693b7ba55a25742d8f99469
SHA25635ef4f0d5c2f97311b43d9c124221b9554d7be64c0d64cbced8e32c8a23b64ab
SHA512ab5ce39e019940d7abdd7d5a67db5e9976950f7115dbe12993c3bca463ba9addf9e11c290a855f75263726d21995c70eb94e4cb464a64beac2c7c50ebf4e5aab
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB