Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2023, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.exe
Resource
win10v2004-20231130-en
General
-
Target
ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.exe
-
Size
7.1MB
-
MD5
7a0708f92f4d73d35fe56185d124f2b4
-
SHA1
995db7c174fe2a860da049c3a6f0a92c71c74ef9
-
SHA256
ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec
-
SHA512
76952ea66d3cb2b59e886db0d87e463f1fa119c84b1e7d836e8a9f681b01cfebe242a4837c2489b58a6f8ef905834e3ebf1c8995416f3608b6d57acadc1276eb
-
SSDEEP
196608:vxm5D5YUyRe7VvZKwamjGKAVW7R+gSoASGm8PvsLMwzj:rRepZKwaS79SoASGDP0Qwzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 3540 numgif.exe 2384 numgif.exe -
Loads dropped DLL 3 IoCs
pid Process 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 Destination IP 81.31.197.38 Destination IP 194.49.94.194 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\numGIF\stuff\is-VCES5.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-18Q0F.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-N2CIA.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-4QPGT.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-4M3OB.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-QLDI4.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-12H3L.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-JVOV5.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-O6QF3.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-CEPOE.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-979N5.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-P84H7.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-99FNN.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\is-J9LD9.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-7QG27.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-18GHN.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-01PII.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File opened for modification C:\Program Files (x86)\numGIF\uninstall\unins000.dat ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-PQ4HF.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-94SCL.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-H8CS8.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-OT1TM.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-HVOKO.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-UDH3L.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\uninstall\unins000.dat ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\stuff\is-3VOKJ.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-BMO1I.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-HLTT9.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-QAL23.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\uninstall\is-063NN.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-FONJ9.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-6GPDR.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\plugins\internal\is-EG8OO.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-D68N0.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-90KUG.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-9POO6.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\lessmsi\is-R4302.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\plugins\internal\is-OQ04E.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-G8S99.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-3DKCD.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-15FCM.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-3KC54.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-1C947.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-KMNUT.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-DE5PN.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-N0BS6.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-ISP4A.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-2O200.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-E1T8U.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-VUK8C.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-806K7.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-NE2A5.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\stuff\is-5MKQ2.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\stuff\is-IT6RU.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-31QVN.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-C600R.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-9DFDP.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-HABF1.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File opened for modification C:\Program Files (x86)\numGIF\numgif.exe ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-TCQJ7.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-D91PT.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-K7HHC.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp File created C:\Program Files (x86)\numGIF\bin\x86\is-F8T6I.tmp ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 628 wrote to memory of 2892 628 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.exe 86 PID 628 wrote to memory of 2892 628 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.exe 86 PID 628 wrote to memory of 2892 628 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.exe 86 PID 2892 wrote to memory of 1052 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 89 PID 2892 wrote to memory of 1052 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 89 PID 2892 wrote to memory of 1052 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 89 PID 2892 wrote to memory of 3540 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 90 PID 2892 wrote to memory of 3540 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 90 PID 2892 wrote to memory of 3540 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 90 PID 2892 wrote to memory of 1032 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 94 PID 2892 wrote to memory of 1032 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 94 PID 2892 wrote to memory of 1032 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 94 PID 2892 wrote to memory of 2384 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 93 PID 2892 wrote to memory of 2384 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 93 PID 2892 wrote to memory of 2384 2892 ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp 93 PID 1032 wrote to memory of 4164 1032 net.exe 95 PID 1032 wrote to memory of 4164 1032 net.exe 95 PID 1032 wrote to memory of 4164 1032 net.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.exe"C:\Users\Admin\AppData\Local\Temp\ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\is-3HH9H.tmp\ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp"C:\Users\Admin\AppData\Local\Temp\is-3HH9H.tmp\ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp" /SL5="$5011C,7235080,121856,C:\Users\Admin\AppData\Local\Temp\ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1052
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -i3⤵
- Executes dropped EXE
PID:3540
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -s3⤵
- Executes dropped EXE
PID:2384
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 123⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 124⤵PID:4164
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
897KB
MD5c63f1c5ed4bb67d3c38eacddd5e90a9b
SHA19ff0c5e3e6b8a73a283ae340782c94ef11968bf1
SHA256433119c63ec272eaaf96984a1e43ae791fe108f706650cec0f661b6460d0e94a
SHA51240b99044bd930c265df3b3f46529e75bf8e07f7d238947967df9d5d3518398e95ff13e5bf19888b37221a1614e452727757de77fafd6f3ceafd4fabe2c16c9aa
-
Filesize
1.9MB
MD56b7ede7c9085e62e575118a834168cc3
SHA16fe4fcb42e1e3b85cd244faec37974fa1e1950cf
SHA256dd327069d9386175d0dce952578540318d8b24d6918426d8a9b8d1bb2ff953b3
SHA5125d5658ceebe7fca7bc32ed9e66e0330a9c495371862ebd7aed0d559d5beb809d9a90880ae02384c1ea47ae36ce2296c6dde2d75e6e3a964556a2ce45711d1e4f
-
Filesize
42KB
MD5f0f8f36ed744729327c1022d05bd0cad
SHA1561beff04eb6f09a8850d36a76273d0d2a5ff994
SHA256da24e22a59136f44e82193ba1e44e213c8af9949341d60ef35ccdb566f964006
SHA5123e4660b871d9addf5fd59a7e71420fb0d6e830dfa14449792c0384d9bf55bda564e0fd276b0a1a50f43a51709c6d9bacfc0cb478d0f630c849f8317ded59d0a4
-
C:\Users\Admin\AppData\Local\Temp\is-3HH9H.tmp\ff9db793dcad8c2aff14b64615e7c9e38e8a44839066f5a362fc6e9b2ba0f1ec.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303