Analysis
-
max time kernel
1s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
10-12-2023 22:44
General
-
Target
7efd87cb9facce4e82b5b1d037e1e2668d584e43b8166afdf7fe0bceabab14c3.exe
-
Size
6.9MB
-
MD5
7687a6093470ec3dbd3f8b5b2f6b6c85
-
SHA1
760134ad1014abd55e13982c31a27aff1dee0a84
-
SHA256
7efd87cb9facce4e82b5b1d037e1e2668d584e43b8166afdf7fe0bceabab14c3
-
SHA512
7a86c6c94beca2431edcb4d0c717dd8287407d62ab0bdab828c2ea2aea4e8506ec5cf320c425482ede7f27effac0a3e54893aaa1259ed227db423c7459d1c400
-
SSDEEP
196608:OxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:mNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7efd87cb9facce4e82b5b1d037e1e2668d584e43b8166afdf7fe0bceabab14c3.exe"C:\Users\Admin\AppData\Local\Temp\7efd87cb9facce4e82b5b1d037e1e2668d584e43b8166afdf7fe0bceabab14c3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5M62S.tmp\7efd87cb9facce4e82b5b1d037e1e2668d584e43b8166afdf7fe0bceabab14c3.tmp"C:\Users\Admin\AppData\Local\Temp\is-5M62S.tmp\7efd87cb9facce4e82b5b1d037e1e2668d584e43b8166afdf7fe0bceabab14c3.tmp" /SL5="$5021E,7025884,54272,C:\Users\Admin\AppData\Local\Temp\7efd87cb9facce4e82b5b1d037e1e2668d584e43b8166afdf7fe0bceabab14c3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5c14434ea7b92e2d2a31b7301b5f2e5af
SHA16ab55170f81c46abcc3622eb6bbb4ece73f1e464
SHA256d6ebc07256c98f9e98d2e37d07e5b46946b1c768f2f0b178d51ae99bc36c5a05
SHA512afe30d56323972bf13145df56f79db718e4cc8d9fdfda32fef8ce845c9885717c8723226907a85f14604565252116ea833b8935a3a465889de231fe9cb822e82
-
Filesize
79KB
MD5bdbd39721674fb2b7d2d2b2fa5c37c63
SHA134284358805c2ee688ef7fca0d90da38ac6f0f4d
SHA2565d1c7d506db5b002b53c12f2943bc46dcec4ea028ca8fc3989671480f3c277da
SHA512c73695bab4f934cdb959c2362f95ea228b2d1659e3d31d616c07c354ce6c797ee7b4d59e0731101906bc37199bb1892b5acb0be37f7423f6e52955fcd42b9583
-
Filesize
35KB
MD5e4ab356b396ce0317f7e63352acc459a
SHA1bd6a3999403459eddd65a3d276be3318926de07d
SHA2564a84dfc754d8332bba43378428fed56a743ae92187d8ce3a1de5ccb9139cee4e
SHA512d03adba5fce6b5d639fa44222853775c7d05bdfada8044038b5becbb28c1834e698fb9ab97e00a783d15b7a743769efa5e2f6f2e219f8f7cb17f2b52df847d39
-
Filesize
1KB
MD514d083317674748d4cb8e3384484c890
SHA16b8c9037700f569ae228d1c8998b1d9faea21a48
SHA256199e49960b2cc64da68cc9822271d7a667112c42703f976d38258f8c83a78a67
SHA512f3d093902aa2d158e726ac6dfd689036352fdef5c6345941cc747fc175701ccc4e0215567e9620abfd17fa3f84cab07e1654957ce56c2fce4a6b898faf253de2
-
Filesize
41KB
MD598bf35b4e3d23321fe91b20542c63021
SHA168edf33845ab0b1ad27eb504e670085bf3f27554
SHA256d1f345040e05b5062a08bacb97899382f7f516d7cfd7d0066e3e19fad10e2a0e
SHA51242be4bc96251f3fb5b31fcc9d1d95df24ec373cbb39555f38b0f1875cc381025fa677d433cad3e76ec60c773e1cabadc0fcb7d12dd0bfe2d2827bb1e256c9829
-
Filesize
1KB
MD530f56d3dcdbb4cee25cac7637364c580
SHA199fb8bc836254b3d273fde24225fdecbfbf58253
SHA25624925300046609e14788b5a383ecbf2b11eeb555bc8b2f99ed0729cf904e0128
SHA512183246d537305beb844dc9e9b62f400f7a565b38f014cf31962c373be5fff892b48dfeb59a552a15b94dee7d687c2bedcc3e283194a9e4244183e7bca1a1f121
-
Filesize
1KB
MD5db6184777f072d8f3d28804aa99da162
SHA1b62f98de6ac12318bb03da9a5329dc7930a474b4
SHA25604d109206044de4c8c52eb3bf17bb335b195f181d7740d18e89b5deb3e0e48cf
SHA512f530c401a202aab567d956a8ea40e76339421408ffbe663672736356e83de4e10992960a644097e4e9f20449be62be9eafa3cde50d6e8c7cd2026c7dde4baec7
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB