Analysis
-
max time kernel
143s -
max time network
130s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
10-12-2023 21:59
General
-
Target
e52d9a7740cb4c963d6d7a1d6265f15c45591443244efabcbbf3d548c90d884b.exe
-
Size
6.9MB
-
MD5
a9837e18e68d389adcbea122b0e57229
-
SHA1
dc2b863c85f815a79051d2645eaa318e72a44a1c
-
SHA256
e52d9a7740cb4c963d6d7a1d6265f15c45591443244efabcbbf3d548c90d884b
-
SHA512
6dc2359005750e24c814793057a1c18bc26a1a5571ea336dd771a0cce5a1e1c009453781865ca267c3f7d2881335ebe485e764c9732879fc04a67986d026d936
-
SSDEEP
196608:rSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:rSjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e52d9a7740cb4c963d6d7a1d6265f15c45591443244efabcbbf3d548c90d884b.exe"C:\Users\Admin\AppData\Local\Temp\e52d9a7740cb4c963d6d7a1d6265f15c45591443244efabcbbf3d548c90d884b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-A3TV1.tmp\e52d9a7740cb4c963d6d7a1d6265f15c45591443244efabcbbf3d548c90d884b.tmp"C:\Users\Admin\AppData\Local\Temp\is-A3TV1.tmp\e52d9a7740cb4c963d6d7a1d6265f15c45591443244efabcbbf3d548c90d884b.tmp" /SL5="$600D8,6998999,54272,C:\Users\Admin\AppData\Local\Temp\e52d9a7740cb4c963d6d7a1d6265f15c45591443244efabcbbf3d548c90d884b.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576KB
MD53dc4a6a64733e4d572036462f9411f51
SHA144d70d25cf8b25f27f1f9e8eb7744e5db1772436
SHA256be381d6e8889d04b3bbd9062b67d69312f5c169166d72a56afe8d70ebe8fb56f
SHA512ecb623d96b67618fd046b784a031940068a38e1c272f3013f825587165885a0119f73c8f4438c9d1e471d5027eb6338dec989be1fef9a17d325cf606c4c83e1a
-
Filesize
397KB
MD5b2da188a68498b42cd956a4409417b60
SHA1b67c1b9007629ee906e66aea7f7b41b115c4af45
SHA25686a8c3e7ed170f6dddeb60bbe792b046acb65f6015efad4fee72a52866352a33
SHA512dd8fc95ce4c10c9047afffca288d26979aacd2b245ffe9d6e0d64996171c670a3b5d4f338b548e96585d79e4c0c601318207155a5d9b5175b18aa16ce3c386a4
-
Filesize
358KB
MD5ab16e56cb1e32f9868f1342a464b62aa
SHA174f448ba42e0cc40bd7db136844979cf3c7937e8
SHA256df554e11f4c5f8bbdb7e1d7719f583ef4844692053bed50244f66811898b0dcc
SHA512a70b26a8dd46a08c37eb4023c575e0e3b172697fda58312935e5a5134e5851b276ce74578e796b9c2e5da7e9683b02c40e896767268cbe1e1fbddc4a4a86764a
-
Filesize
484KB
MD5796d3aba3d5eb5b21b8565d2a5e6d727
SHA1d8cfa45b46cac650454f0c718b32babeb3b67987
SHA25608a42dbd32e2097c398daed6e03c53e8c3826c193c3cb33c77a2920a62a8175b
SHA5127b006aaacd916568a0d68ed704881cdbb319dce972b87d3df65a6a0df106941284f96a6f40468bea1e7ff1c1371822f8b26b69b6431a0d8e95a03efc11e64ade
-
Filesize
647KB
MD57f904567c817948597548b726bbd9164
SHA16cd41a5d0a0772cb7b988db3e7e1c5a215b55410
SHA2565104d34a647cab9f6b2fb1e5793cb28f4c5933fb768ea238f2cd41d808fac7a2
SHA5127cc73fc554c2121afc5de05d4e3d0b939ce02667dcdc5fe7d39259bc92d3fdd4ae5fbc67b0401b6077e5318ffac2cc4d9d42e543ddb6a9ad89720ff26f9348f2
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB