Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 22:29
General
-
Target
ba7df536f665581058b0f9f4b586c7e93016d12cb6473efe67b17ead4fe6ae0d.exe
-
Size
6.9MB
-
MD5
d13538c5870d1eaeda1005b271c6f5c0
-
SHA1
de9903629856fde37e604e616a7f49dcbcb6471d
-
SHA256
ba7df536f665581058b0f9f4b586c7e93016d12cb6473efe67b17ead4fe6ae0d
-
SHA512
823abef71b92307d29a38f606282dc86fde0972171ab77ca5d70478aff58a5dd0c28c84f52cfb18e41ebe281dd329a51ba11ef72457790c4fe06ef8f08e85ec4
-
SSDEEP
196608:rxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:BNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba7df536f665581058b0f9f4b586c7e93016d12cb6473efe67b17ead4fe6ae0d.exe"C:\Users\Admin\AppData\Local\Temp\ba7df536f665581058b0f9f4b586c7e93016d12cb6473efe67b17ead4fe6ae0d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-92M7C.tmp\ba7df536f665581058b0f9f4b586c7e93016d12cb6473efe67b17ead4fe6ae0d.tmp"C:\Users\Admin\AppData\Local\Temp\is-92M7C.tmp\ba7df536f665581058b0f9f4b586c7e93016d12cb6473efe67b17ead4fe6ae0d.tmp" /SL5="$70056,7025884,54272,C:\Users\Admin\AppData\Local\Temp\ba7df536f665581058b0f9f4b586c7e93016d12cb6473efe67b17ead4fe6ae0d.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD548d277822fae0c13f4c2fe714f00c6dd
SHA14e002a2b1f1ec87b043d239d1eef807bc3d8e241
SHA256007e0c7426f1fe885c802152afd79eed9555d05b7760a93efb3d8d7344023656
SHA512e86eecffa3a41c39898021e9df3be7189f3ffb3eeb840288cbd5b9da77c5946d4be83ea7d91f53b19ae252f7aa4c91f68338fb6fb009353eda6bbbf3323643e0
-
Filesize
65KB
MD5da4f3697b17ced1d2baf410b120a8359
SHA17ed8c4b1daad061720a0fe079b714bdbdf0ef2f1
SHA2569b3e47728de0aabaae0cafedaae1eddbcfd709e49a6ac79c123f3f081cdb5ea9
SHA512f753d42f8c2de851c016c6f4f1ee9e16dc7d841afd77a27eda0c0c35a3296cbb3e75886ef3ed4c86686dc83327eb4f51ec163bc6d2ee838e4b13813440b231ac
-
Filesize
85KB
MD5855897ab27178cfed6ff41c4c02e7795
SHA1b5cdfbaca73c81b39db3c4208678fce5b38568a7
SHA2564d4f318ec90e7e988e6bacabedfabe527623fd1551872294dd217d6098dd49d9
SHA5123b24c174230112a8c29ae2f2484b4c02309df7c2f0084dcbc2e625e960331836e124885aea35810d475d4fb42e112bc79f2731dc469a055c8cd8b032c1d54d29
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
68KB
MD5964c614ca76035b64fc29bd90379d4f8
SHA1c9a3f0cbad5b346990b9a309cd8b247255488956
SHA25684c543e7497fc58ead3ca7990eef2d055a23f1c663ecaa78ac90e97fe0308da4
SHA51247bdf7cc9d627ef39823b9041f3d3b047ee5865f039ee19ee042f621b13c2608fba68c7c396b931f4117a186da29b2d3b197ac68f570712e5df1c9a6b7af724f
-
Filesize
49KB
MD510dcfca66cad4877702a08201f15f7eb
SHA11543d5062db06524997dd39533132789828c5906
SHA256db8fc225e50015d56cd41f0fc8e971bcbb36762f599be7e1cf7bb96987f8f68b
SHA512dc256228b4d30e4d323d938aeb444f603b1043e2ab66e50fa2dcb08ff8b0e65b6ccedcc9063be95294c09cc7de79d8be78c45e08c427ed7705b11d11159e067c
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB