Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 22:59
General
-
Target
6e050a71cea0bd495ef6a7346a84613395435636421a1d40b6e9910faf1bf911.exe
-
Size
6.9MB
-
MD5
0ba14bb422c8a359c99b78b0228fb760
-
SHA1
a64c782f6ce2a694811a952005e240acf8fbce5c
-
SHA256
6e050a71cea0bd495ef6a7346a84613395435636421a1d40b6e9910faf1bf911
-
SHA512
588c2e37efe3e69031eedf9d23cc00dd249ebc6d69e7097ff3284d12789902b33e1c085b8b58b4f05cd5876e63bc6aadfe42adcc34729e3928becfbf92e9ce91
-
SSDEEP
98304:s+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:1z25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e050a71cea0bd495ef6a7346a84613395435636421a1d40b6e9910faf1bf911.exe"C:\Users\Admin\AppData\Local\Temp\6e050a71cea0bd495ef6a7346a84613395435636421a1d40b6e9910faf1bf911.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SNAL0.tmp\6e050a71cea0bd495ef6a7346a84613395435636421a1d40b6e9910faf1bf911.tmp"C:\Users\Admin\AppData\Local\Temp\is-SNAL0.tmp\6e050a71cea0bd495ef6a7346a84613395435636421a1d40b6e9910faf1bf911.tmp" /SL5="$C0060,6985375,54272,C:\Users\Admin\AppData\Local\Temp\6e050a71cea0bd495ef6a7346a84613395435636421a1d40b6e9910faf1bf911.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181KB
MD53f720273f88c37ea7a9956ec2455ec42
SHA155c6234522e72d9e42616ffba1a85eb0e18ab421
SHA256dbff23a3a9f7b9e878a00104bee146b0e3e43f5fc224c2a2f4bd26978660f564
SHA512ba03e71bb4694e4a1a714d99ed43bd2f87880e7fddf4cabd2673a509a033337adb037f0bcbbc95470cef84751fe5a18b3e3bd273354c985209605167e947f163
-
Filesize
200KB
MD546e8c586a3774bdbebf263114c957409
SHA159d1323373641b8c846ff35471876352b820bcbf
SHA256016a7dc074f491f225604bcba5a9a7089c14f433d175492fadc617d3b7bf3795
SHA512119906804aacb30e45a0b6c33d63a1b05d764514e87b1f912db42cb0c3ca71cf0080e417f97a5de1f0f5625aa0cf8219d9b5dcedfbe5efd82152ebd74c041642
-
Filesize
130KB
MD5a8a10859f512a3769ce2cd85912af3eb
SHA12e0768765521a8542c9a9a53c24e064b1e1b4e82
SHA25634335ba1b41952c0255ae0a178d502881bdf2c5409d29e8404bbbe6b1997a14f
SHA512622e6043a20202d34a5189e18383be4462ee382a3360c89f2f076993ba3ec5f2a063c127c175ecafcfacd7e2bb05bd63c6368bf54e7bce972e72bcbb4bcaab60
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
257KB
MD52444aac7dd223bf87bba00eb91ff4e5a
SHA1192032da0fe7b2a13e8ac3c823c9555e7db27f5e
SHA2561f4340625a8b2589780853e6ef82a78254d3d5a013c1fddb48970ae2460c30de
SHA51249d9f0a1dfa97e9f3c66a2e2244ad51d300de5c74a6513615966f361c0d8db7a8082539b48820d83be16ba7b6cc791c728d759e57e897a42e35106531fb3dc53
-
Filesize
152KB
MD598a825b5c746cf7802b04f2a9fc8199d
SHA1853486defe3ce57035ac20a8c2a4c1137b5d59ab
SHA256b30b8624455357fa90c12612f61d45fc1a5246e4938af0801911bdd07a59d017
SHA5128f13d396e6b9332ce096029d6cbc858a9d3cce7620b67c4a4b99ffc251067c3339bf31876a70cdb5e95a134c064bb405c63532ccb8112a28892d573bb0259411
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB