Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
10-12-2023 23:15
General
-
Target
1d12f8c7bb63e6cb4c746de08dbafeb87cf8409d280ac955ed01a4dc5c008bd5.exe
-
Size
6.9MB
-
MD5
026dd6f5ab44733110051c0f9e6f3aff
-
SHA1
3b941fffe97091c977dd5ed646893f0e457db34d
-
SHA256
1d12f8c7bb63e6cb4c746de08dbafeb87cf8409d280ac955ed01a4dc5c008bd5
-
SHA512
9eee76cb309bbf9ed7124f2c8757751f451f3d32911ee1db2fb0b2c8a08e3c6a3aeb5f77b87f9afae62ce6c1e7de1af03343e68333fc205f44600b27084acfe4
-
SSDEEP
196608:wA89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:sBmakyVnlUQ7Wz3Tv1jNTh0zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d12f8c7bb63e6cb4c746de08dbafeb87cf8409d280ac955ed01a4dc5c008bd5.exe"C:\Users\Admin\AppData\Local\Temp\1d12f8c7bb63e6cb4c746de08dbafeb87cf8409d280ac955ed01a4dc5c008bd5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-Q7BUE.tmp\1d12f8c7bb63e6cb4c746de08dbafeb87cf8409d280ac955ed01a4dc5c008bd5.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q7BUE.tmp\1d12f8c7bb63e6cb4c746de08dbafeb87cf8409d280ac955ed01a4dc5c008bd5.tmp" /SL5="$B006A,6977575,54272,C:\Users\Admin\AppData\Local\Temp\1d12f8c7bb63e6cb4c746de08dbafeb87cf8409d280ac955ed01a4dc5c008bd5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
364KB
MD5d934663090c19b27fc64aa07cb9c4512
SHA13195cebf4d64cdfcc7d60da0b0fd19e7aa59d52a
SHA256ff22729d910949abd73d2478cf695a9e32b7c28c5ff4e21febf03d700269c192
SHA512376c4eb6ad4fdc576e473b27d92f6c4053849082f8050f0381f547be5b084fb8620a473bdcf550c53544844be82a9e63f83e62054ab882473678b8615fba358c
-
Filesize
250KB
MD5f2fdfaabae40c7852bcb47ae28d251b2
SHA1c0396c5a22d9a3b5935989fb0bcbff89e32e1dbd
SHA256dd8981dafeb58392cbfb857986bf7505c5dc47740e903a04dbc057a22a7ff5f6
SHA512c9f67172640861c1547cab2df1628163763f4e55028ea89176f94720306f4073fe1e558f9692160a06571d1ff6078b0ce04152268ae75f3d436386c276fdfe20
-
Filesize
234KB
MD5f9b861e9ba5335a97ed96b3860e74f7b
SHA12bb29900ad5ea98d2402378654166ca1f4b5867c
SHA2565862af35e600ad3ab81edc2910154c6c6a54f15f980ef1b161908c666cda43a7
SHA5129a6dcd62cf623e0722e5250d1bede11135ff99551b51d6eadd52189386d3723af77d9b8f53f3c50b4b556ce1bb7acbba6673723982354ce5bdcc169648c412d0
-
Filesize
11KB
MD5341b105ae816a2ba2034a6b1bec7e7b3
SHA126608a9d0b9acfe9b789359c46f048d380e1094e
SHA256f29f9854c5b42243fc07a9fe859a60a6806a07426be931e1ceab5fe8e357fa9e
SHA512cedb1e08d2f5cc50b94995bce8412e04801db82d59e67020afdfd9743594c615571c3676b9c4d7e91e895ee6da9410114fde5ef3f6ec5f671e18b93fe50286aa
-
Filesize
28KB
MD54ad6126649f82c2b74002e0801df9e50
SHA1bf127e5c7a06a898b1f807701a7de328bfba67fc
SHA2560cddd5a02d8af3ce696573b06dc6e32cf61e942a6cd32fb2a726df51c47c41c1
SHA5126a897e6451aa68f8e6329dcb035a13618924f6fb3178025f0f332a511a58e0a45c05db0a909b4ce2b22e432dda1b4b3bfef72b123ad9e4bde457d3c380088f47
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
5KB
MD5d76f05753cf31757493471a5b2788334
SHA1991607737c3352b43bd43c57ca3103c09ee4f033
SHA256e50103af44e71869efdb37bd43f1cbc1171c0c06fe98a0c41b36e497764d0021
SHA5125b93b62ec158561851583990e8d304011f77f827d8f9260023a7d2308ee7f5d72fb19776130937dac49ac879e94ae5529c204c3db6c57415f213b10ac5e1801e
-
Filesize
10KB
MD57ddd35bf1a6f7c247e3090c009dff010
SHA1b0338711520f95dba350a37c434c4f099c13b9b1
SHA2566a7e4857a4725a9e0166cbb4ac8b029a988ac20013fa5289313e967b91d032f8
SHA512852d513c439d7e8e865e397a4eb75985242d2718dbc3626b902232b71085c4f9543975055a75c706c0f3d1b4d0b40ad3ab6d67344a3d79642c668313c12a33d4
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB