Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
-
submitted
10-12-2023 22:48
General
-
Target
2b95df8fa528b9dd9065b7216c7d10426d56557992bffdcd70e915902003cfb6.exe
-
Size
6.9MB
-
MD5
5f10e2966082c63fea201117ae85169b
-
SHA1
6c095c462ca5293f52f63da296c3988a628efe59
-
SHA256
2b95df8fa528b9dd9065b7216c7d10426d56557992bffdcd70e915902003cfb6
-
SHA512
a5b80e334b28d35b927ab2aac9bd31a5c2b2f2b39f16218d8e54219c1eea669326128a4a2ca497a0ef24e041e7abcfb76832e864008f4c46ec6e2183e355a308
-
SSDEEP
98304:n+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:+z25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b95df8fa528b9dd9065b7216c7d10426d56557992bffdcd70e915902003cfb6.exe"C:\Users\Admin\AppData\Local\Temp\2b95df8fa528b9dd9065b7216c7d10426d56557992bffdcd70e915902003cfb6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H338S.tmp\2b95df8fa528b9dd9065b7216c7d10426d56557992bffdcd70e915902003cfb6.tmp"C:\Users\Admin\AppData\Local\Temp\is-H338S.tmp\2b95df8fa528b9dd9065b7216c7d10426d56557992bffdcd70e915902003cfb6.tmp" /SL5="$C0064,6985375,54272,C:\Users\Admin\AppData\Local\Temp\2b95df8fa528b9dd9065b7216c7d10426d56557992bffdcd70e915902003cfb6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e5b765cf0501fadcf9c5763e89bc93a5
SHA19f6aedd072edc28ab7eee22e21fac3e254fd20a2
SHA256fd0ce359fff6a91830734f90c0487ab08c6ff839a5fe1c5712d3894b562b9a7a
SHA512baff089fddf2b38e7eadb2d745520cff13648e3317e05a13ad4c14061c6532206e81c67c39b8112599ef736480f9b94b08955da1d1faef57d508995d48dfcc0f
-
Filesize
65KB
MD51dceb1405bbb8bef8ee6aaad6d26311d
SHA14861bca6f305dd48bbf77f2fe238bcae804c37a7
SHA2569bc66121ee6d5bf9d566fd1612d6c32fdb4a694386da2711326dff8ae8157bcc
SHA512a1ebc3ee2576863101008d8fbbe38f0a0c22ab54a2810a16b3095620833ca7b3c3ebf4314b2f8d3fb38e330dbf29308dfb704c63dc064286e72955cb17e532b5
-
Filesize
45KB
MD5f8c8d78ecfe7b224697c2ebbd8328f48
SHA123983c7c8cb642c11ba9b28de1076b7556fdbbb5
SHA256f5703ccbc3049c493796f754f7a1b65769f32c5349c0126f0edd312443417c14
SHA5121de7f67f2b6e83b292373b55b7c002205558dd12fd1f1621753a87f98cd88cda6f94dfbf23f267492866a15f84186c6cd2f513d597d66b38c6fd9ad64c7d85ab
-
Filesize
79KB
MD522540fe1d370dbb07162d98c574da026
SHA1f64f401f00e67660f25607a10aec3a038913c9f0
SHA25698dc51bc0f12fdd20dfabe3d1b8468aac31d4fda8904687a30b7cb1b18797ed2
SHA512323db9d5f0578794f880e318df6a8214f946fe45042d4db94a1dd88ee3b8a080171d85290197f8d680ca6e47e952351b2f28801c43c0172446cfdd98fefa9d3d
-
Filesize
15KB
MD5a69054dfed9fa1fb17542e4f84fad041
SHA1134d4c36e9dac66d15649de346d830d5960e8c60
SHA256b4247b1287e02675a9373988c04f3f8504a5fd1543fc367fdd4a651bc0447287
SHA5128e274930ebc678a6e6844032907d81b6f347eb670ebbb9664a46d8f08fbfd48291c1401a4fe90a34487b072f4a51605e9be469ee0b56f3fb6cf803eb7953098f
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
1KB
MD5fd9648f0e3d3a6ea8e202bdad81e1874
SHA107aa70a3b0949a70a92a58f71f6fff6baf68d432
SHA256aa6e590429a24b0f030608d4d08713de5ebcb8cca0052f76b5ec0038b456e81f
SHA512689de576832abadfe15bd18bc43aeb2e3e63a751bb9c65223bf4a09cad4a65c7cf9c97ca7d8e6e827bf61bbf13ffeea3167a19bb993cfe72b78b95a2db43e1ae
-
Filesize
1KB
MD5db6184777f072d8f3d28804aa99da162
SHA1b62f98de6ac12318bb03da9a5329dc7930a474b4
SHA25604d109206044de4c8c52eb3bf17bb335b195f181d7740d18e89b5deb3e0e48cf
SHA512f530c401a202aab567d956a8ea40e76339421408ffbe663672736356e83de4e10992960a644097e4e9f20449be62be9eafa3cde50d6e8c7cd2026c7dde4baec7
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB