Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 23:23
General
-
Target
ed8c1750f1fc63c7c993251ec77d584fc1de5046384b9162f76b6500cdc18893.exe
-
Size
6.9MB
-
MD5
21dd48fd8dfd63d570bf8df5d1d3a66c
-
SHA1
55a047ce475f9c097c767c4645e24b71be145673
-
SHA256
ed8c1750f1fc63c7c993251ec77d584fc1de5046384b9162f76b6500cdc18893
-
SHA512
48f4aa1b46f3b700408ddbc7eed4d0633b9625ed34d72fdb5511ac5fa6bdfafccf141c4f4aeb877a7d675c9bc65ed4a982890ccd0fb3f0aa9c30e2dfc6f655e6
-
SSDEEP
196608:nK2+nNevvWstwr2m5BmycyEbSfasepd5e4x6+AjZ6mjxzj:nDY6tiP3myRfzepXe4ny8gxzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed8c1750f1fc63c7c993251ec77d584fc1de5046384b9162f76b6500cdc18893.exe"C:\Users\Admin\AppData\Local\Temp\ed8c1750f1fc63c7c993251ec77d584fc1de5046384b9162f76b6500cdc18893.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OEKDD.tmp\ed8c1750f1fc63c7c993251ec77d584fc1de5046384b9162f76b6500cdc18893.tmp"C:\Users\Admin\AppData\Local\Temp\is-OEKDD.tmp\ed8c1750f1fc63c7c993251ec77d584fc1de5046384b9162f76b6500cdc18893.tmp" /SL5="$50066,6991381,54272,C:\Users\Admin\AppData\Local\Temp\ed8c1750f1fc63c7c993251ec77d584fc1de5046384b9162f76b6500cdc18893.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
904KB
MD5d9c7e867e1e7fcf86903b0dd40750124
SHA10d61d13bf63be60d0125beca78132f05cf03f06d
SHA25604990f9dd4e6f2ec3157e334acc31ac34a5c0fe40e52c6a8b82d86fec0790099
SHA51209285d2651467b2453fd34c56c268d06564d8ece8c863d5f9b6e57f977be307c8cd45c6cc0556ace87c895b93501d492ce9616ed5e807b2a7e5a9cfd3f346599
-
Filesize
668KB
MD553e24be1bfcd7ee1bdf4e03ae18b10a3
SHA1116484686cd73d887e3b94ff07822f85d52d0515
SHA256bc13e78342e2f33b5f56a08840187c62011efde8e92226db2c440b4ac72b2ea5
SHA5120c76c336b552d3e939c43f2504d59790ae0e9940258335d55acc83d5da1a4d166ad3edd5e9255949a5f707587f372a0e7d75fb19e1f535cddceef64add423a58
-
Filesize
653KB
MD534977e17f391091e1aa461039a62c0f1
SHA106f9c7459cc4bb9f364010ead5a2465d0107fdab
SHA256eb14ffaa28853226b5a2fb528a998cefc2887b319496462d33925aa293197489
SHA5123fcbc365b1d8eb3677d6e62478e7a872b4eb5eacd417334bcf9906e0a9d479bfd380244ce3901d974b55892fd9a55f9e02ed565e015f867fa07ed1eb0af827c8
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
382KB
MD53396d7fee3f24573b74b26b347a75cc2
SHA1182c310b7331bf05bd7e2c4501d45cc31217575a
SHA256096e0e259af4c02166ba6f4967a931b582ce4c16e76de52921c5303cb0266d3a
SHA5121e28ced4948de5d97d6a0ce0274bdd870743c09e754d84d4da0a1b14ba800fdd0a121618dabb1773e49f088e5f6796433055b80944ea2a9e865e4c69de57afab
-
Filesize
300KB
MD5151dd19f7716f1d630462e35565fcf8d
SHA14cb01c7a753ecf71eed38cd71a54051885b2e172
SHA2566b79892e602340248e194551a9f7b8064b2dda86d75f5af21deb32a6f01c39df
SHA512996748de4605c3b3824464377c7274511859cb30054bf4f5bca44684e0f22aa6dd24f530b2103a9dbf36e686331cf7113a3310264838ebbaa94f1f872dbe494f
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB