Analysis

  • max time kernel
    143s
  • max time network
    134s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/12/2023, 15:55 UTC

General

  • Target

    e0ad6b108e35c4a076db653be3a3fc0d5ea5269cd9c26082d7ad5f7d56f1b75e.exe

  • Size

    7.1MB

  • MD5

    60033fd822ad81e803c9fc95e61663d9

  • SHA1

    e411f52db6f0637dcd78c1d385b3f44d41aaae3f

  • SHA256

    e0ad6b108e35c4a076db653be3a3fc0d5ea5269cd9c26082d7ad5f7d56f1b75e

  • SHA512

    af1ee0bc42c3ac917b60d3f7816547d32825fe5499132093d6c30a39e7092655d613e9f593a7b4cffc498a7686d45a3bc77ec460c29cd97daf1c37968955eaf6

  • SSDEEP

    196608:Wxm5D5YUyRe7VvZKwamjGKAVW7R+gSoASGm8PvsLMwzj:wRepZKwaS79SoASGDP0Qwzj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0ad6b108e35c4a076db653be3a3fc0d5ea5269cd9c26082d7ad5f7d56f1b75e.exe
    "C:\Users\Admin\AppData\Local\Temp\e0ad6b108e35c4a076db653be3a3fc0d5ea5269cd9c26082d7ad5f7d56f1b75e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Users\Admin\AppData\Local\Temp\is-MKCF0.tmp\e0ad6b108e35c4a076db653be3a3fc0d5ea5269cd9c26082d7ad5f7d56f1b75e.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MKCF0.tmp\e0ad6b108e35c4a076db653be3a3fc0d5ea5269cd9c26082d7ad5f7d56f1b75e.tmp" /SL5="$50234,7235080,121856,C:\Users\Admin\AppData\Local\Temp\e0ad6b108e35c4a076db653be3a3fc0d5ea5269cd9c26082d7ad5f7d56f1b75e.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:4108
        • C:\Program Files (x86)\numGIF\numgif.exe
          "C:\Program Files (x86)\numGIF\numgif.exe" -i
          3⤵
          • Executes dropped EXE
          PID:1784
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 12
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:208
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 12
            4⤵
              PID:3728
          • C:\Program Files (x86)\numGIF\numgif.exe
            "C:\Program Files (x86)\numGIF\numgif.exe" -s
            3⤵
            • Executes dropped EXE
            PID:4052

      Network

      • flag-us
        DNS
        13.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-ru
        DNS
        bvcygqi.com
        numgif.exe
        Remote address:
        152.89.198.214:53
        Request
        bvcygqi.com
        IN A
        Response
        bvcygqi.com
        IN A
        185.196.8.22
      • flag-us
        GET
        http://bvcygqi.com/click/?counter=de7ef49b2c006853fb386f286603a64267f71905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f528166429e289d5b86953e226c55f676647fc2813369d184da325a508cd200ff13cb
        numgif.exe
        Remote address:
        185.196.8.22:80
        Request
        GET /click/?counter=de7ef49b2c006853fb386f286603a64267f71905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f528166429e289d5b86953e226c55f676647fc2813369d184da325a508cd200ff13cb HTTP/1.1
        Host: bvcygqi.com
        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.20.1
        Date: Tue, 12 Dec 2023 15:58:06 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        X-Powered-By: PHP/7.4.33
      • flag-us
        DNS
        5.2.1.6.2.2.9.7.8.9.0.b.c.6.c.5.e.2.0.f.c.4.d.6.6.d.6.c.9.5.8.9.ip6.arpa
        Remote address:
        8.8.8.8:53
        Request
        5.2.1.6.2.2.9.7.8.9.0.b.c.6.c.5.e.2.0.f.c.4.d.6.6.d.6.c.9.5.8.9.ip6.arpa
        IN PTR
        Response
      • flag-us
        DNS
        214.198.89.152.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        214.198.89.152.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        22.8.196.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.8.196.185.in-addr.arpa
        IN PTR
        Response
        22.8.196.185.in-addr.arpa
        IN PTR
        g3fmytasteoftodaycom
      • flag-us
        DNS
        10.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        10.173.189.20.in-addr.arpa
        IN PTR
        Response
      • 185.196.8.22:80
        http://bvcygqi.com/click/?counter=de7ef49b2c006853fb386f286603a64267f71905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f528166429e289d5b86953e226c55f676647fc2813369d184da325a508cd200ff13cb
        http
        numgif.exe
        479 B
        352 B
        4
        3

        HTTP Request

        GET http://bvcygqi.com/click/?counter=de7ef49b2c006853fb386f286603a64267f71905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f528166429e289d5b86953e226c55f676647fc2813369d184da325a508cd200ff13cb

        HTTP Response

        200
      • 8.8.8.8:53
        13.227.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        13.227.111.52.in-addr.arpa

      • 152.89.198.214:53
        bvcygqi.com
        dns
        numgif.exe
        57 B
        84 B
        1
        1

        DNS Request

        bvcygqi.com

        DNS Response

        185.196.8.22

      • 8.8.8.8:53
        5.2.1.6.2.2.9.7.8.9.0.b.c.6.c.5.e.2.0.f.c.4.d.6.6.d.6.c.9.5.8.9.ip6.arpa
        dns
        118 B
        182 B
        1
        1

        DNS Request

        5.2.1.6.2.2.9.7.8.9.0.b.c.6.c.5.e.2.0.f.c.4.d.6.6.d.6.c.9.5.8.9.ip6.arpa

      • 8.8.8.8:53
        214.198.89.152.in-addr.arpa
        dns
        73 B
        127 B
        1
        1

        DNS Request

        214.198.89.152.in-addr.arpa

      • 8.8.8.8:53
        22.8.196.185.in-addr.arpa
        dns
        71 B
        107 B
        1
        1

        DNS Request

        22.8.196.185.in-addr.arpa

      • 8.8.8.8:53
        10.173.189.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        10.173.189.20.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\numGIF\numgif.exe

        Filesize

        896KB

        MD5

        bfa1a8b06c80d838c60c935a556986bf

        SHA1

        95e8141a70273d5b190ec0ed2ad2667cac6c829c

        SHA256

        d4b68ddffeb61f9ba3183edcba155724ded05402a143e36c3934a53f9be4b6fc

        SHA512

        d6f42899932ad155b5c936ffcb3e560037b54ee4711ba90eccfa975bbe74ff6f0a22fbb64f8e9bff3fa6d58c53fee417a2a17c91625f8c00f92edfa521a24979

      • C:\Program Files (x86)\numGIF\numgif.exe

        Filesize

        320KB

        MD5

        ef9bfa2f7653c7b0f6c6649917f790a2

        SHA1

        71b4f20b957733b6c26e4175904d0ff8f453cfa6

        SHA256

        223ae66f045275bf9e7b7c48e2e860a4d3c15657284d195e63673b276f02e011

        SHA512

        9474dde2da55ed301de1a0cee63ed559b2074f5dc7e7c30e4f9ef8368601228d2ba7856c9046e9f752c2ec38650b110be35d44b66ecb103ddc1518b561980355

      • C:\Program Files (x86)\numGIF\numgif.exe

        Filesize

        2.1MB

        MD5

        95ed12773ef7a56b65865ed9cc8ae391

        SHA1

        3ee35b36071df39b2743fd1cb449e1d274a2b976

        SHA256

        7cc9b31f29184290d59f521f08963feebcccd59fa7e23553a7e4770d3e1fcaef

        SHA512

        dc415bdaa91eb5c6bb61f0f986a20ca48dc4455fcf3dccb40be4e2dddb331bfce677fcf92f10fdafd536f47e079a7ea02e85b93cbf806d9eb915b296f053a288

      • C:\Users\Admin\AppData\Local\Temp\is-MKCF0.tmp\e0ad6b108e35c4a076db653be3a3fc0d5ea5269cd9c26082d7ad5f7d56f1b75e.tmp

        Filesize

        687KB

        MD5

        f448d7f4b76e5c9c3a4eaff16a8b9b73

        SHA1

        31808f1ffa84c954376975b7cdb0007e6b762488

        SHA256

        7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

        SHA512

        f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

      • \Users\Admin\AppData\Local\Temp\is-VROPB.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • \Users\Admin\AppData\Local\Temp\is-VROPB.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • memory/1784-150-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/1784-151-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/1784-153-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/1784-154-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/2972-160-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/2972-9-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/2972-162-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/3368-0-0x0000000000400000-0x0000000000425000-memory.dmp

        Filesize

        148KB

      • memory/3368-159-0x0000000000400000-0x0000000000425000-memory.dmp

        Filesize

        148KB

      • memory/4052-161-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-179-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-157-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-165-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-166-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-169-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-172-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-175-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-178-0x00000000008B0000-0x000000000094E000-memory.dmp

        Filesize

        632KB

      • memory/4052-158-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-182-0x00000000008B0000-0x000000000094E000-memory.dmp

        Filesize

        632KB

      • memory/4052-185-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-188-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-189-0x00000000008B0000-0x000000000094E000-memory.dmp

        Filesize

        632KB

      • memory/4052-192-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-195-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-198-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-202-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-205-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      • memory/4052-208-0x0000000000400000-0x0000000000629000-memory.dmp

        Filesize

        2.2MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.