Analysis
-
max time kernel
93s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
24/12/2023, 22:02
General
-
Target
145917cdae271c6485a5c2a3b7638b0d.exe
-
Size
4.8MB
-
MD5
145917cdae271c6485a5c2a3b7638b0d
-
SHA1
c092c7d6fb98cbae6f7399bad96e2b0390ebf615
-
SHA256
0291aeb2d4f73bfa69ef1bbd9d7b6763bfbcfb441f7925ce5942e0375d3399fa
-
SHA512
839a0fb8c7c209072b73ea317621ae240a9d3a181a050b0ac2bd339c2e6a1a7468cc28b5a289df69f37bfb15d8beb742840afa4d768d72b4de6c61d6e8fb4d2e
-
SSDEEP
98304:PX4tLbkrIMp58YXSV6jt8gWi3LfMxVHjpyazx14:vocMM8sJ8gWEExrya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 27 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\145917cdae271c6485a5c2a3b7638b0d.exe"C:\Users\Admin\AppData\Local\Temp\145917cdae271c6485a5c2a3b7638b0d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SPQL5.tmp\145917cdae271c6485a5c2a3b7638b0d.tmp"C:\Users\Admin\AppData\Local\Temp\is-SPQL5.tmp\145917cdae271c6485a5c2a3b7638b0d.tmp" /SL5="$90058,4386546,721408,C:\Users\Admin\AppData\Local\Temp\145917cdae271c6485a5c2a3b7638b0d.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Culpa\et\Et.exe"C:\Program Files (x86)\Culpa/\et\Et.exe" 084ee52947bb4e189d3cd934e85d61633⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 8724⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1784 -ip 17841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bd942fe4c38494d654313fd4a1a23fea
SHA1a7fb50d28c3164acc4eb074493c81a4cbbbbdc98
SHA2566b8bbe4ffc899d2c164f4c857eeb65e44e99754d2f8ff1c0cf6def39585e9522
SHA512f09401f7e2dcd546b1aed66fbe7933a89f8ebfdda21dee5941278cd7115365545752305f9fe24ebf0782f61c68dac34aa5f6aeffd683a0ce1d4e64dd45a8c03b
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
48KB
MD5e9d08131d21ea9afb7b1af118f1ebed5
SHA17bfbada194b5b901c8936b37516c913aa046e69c
SHA256b9782c49f82d3988a8b2f1d6d41b82a0b65b3d4307ddb922a579801d966f8b6c
SHA5127ae875dd5755f7ef67a3175d11b7839967e22122a18310f34ddfd8e352551f5c18195908767124c665a93a79b46ca94d2315aa04be0e9231fbb2890fea90794a
-
Filesize
8KB
MD51a545768624baf19a8ec7942cabf6581
SHA152de295f9046408b5dae18779e05d7462a0f1125
SHA256aa77b4a40377f44a08c268c35c3b2b8e9d3f9184d24fdff1e9745a45a5e3ee2d
SHA5122ae5a8dff0b9fcd16812a11ef204c96b24198ccc2673f8d973397a325f19ca285c75238f65369bad602354f8955e7605278fbf557ad0a7d7fc30ffb8a741af8f
-
Filesize
19.2MB
-
Filesize
19.2MB
-
Filesize
19.2MB
-
Filesize
4KB
-
Filesize
19.2MB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
2.5MB