Analysis
-
max time kernel
143s -
max time network
130s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
10-12-2023 23:26
General
-
Target
76e046299a3ea5b2ffc6a40cffd6e007d35ff01a5e29882dbb4fe9f2c5c90b42.exe
-
Size
6.9MB
-
MD5
3e62e9f141d881e16a3e5f42121724ae
-
SHA1
9e9d662229b34f2d3e79150041446d54154142e4
-
SHA256
76e046299a3ea5b2ffc6a40cffd6e007d35ff01a5e29882dbb4fe9f2c5c90b42
-
SHA512
83b36e40e7391b78b36fac48fa0b1309dd9cc4617c723dbaad41e13f136ca653bf78856b2cc01b51f9f5d9dcfa8c5c655b06b914421c394013de3f5af721f127
-
SSDEEP
98304:B+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:8z25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\76e046299a3ea5b2ffc6a40cffd6e007d35ff01a5e29882dbb4fe9f2c5c90b42.exe"C:\Users\Admin\AppData\Local\Temp\76e046299a3ea5b2ffc6a40cffd6e007d35ff01a5e29882dbb4fe9f2c5c90b42.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-62ERE.tmp\76e046299a3ea5b2ffc6a40cffd6e007d35ff01a5e29882dbb4fe9f2c5c90b42.tmp"C:\Users\Admin\AppData\Local\Temp\is-62ERE.tmp\76e046299a3ea5b2ffc6a40cffd6e007d35ff01a5e29882dbb4fe9f2c5c90b42.tmp" /SL5="$50232,6985375,54272,C:\Users\Admin\AppData\Local\Temp\76e046299a3ea5b2ffc6a40cffd6e007d35ff01a5e29882dbb4fe9f2c5c90b42.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
935KB
MD59c6190309681716834541d075193bb1f
SHA19170770fe7af6402aecf1c4ab43a6cb3ae060c6d
SHA256fc154e83bbb991b7e7c43464d9c4211984d82ad39c536c10b07f2377beaca9e8
SHA512df477c951553786d5486f4d8f178e3c3e497ef16a543ac3ed15310b8d126a11a16c160b1c2aaa5ebe63af2ca56da543c6fad7e15d7b426db93a63808b199f8db
-
Filesize
790KB
MD587a130f2ac3fe37ce9cf67af63721a1c
SHA10b7b53156130e3ad82c29751662df6b1a45530df
SHA256df6544d797d80fdcdcc0d5a6c8b65f8e5bd735ae5403d87363165487173b5e8b
SHA512740675a42cf370f48a46855586b20f52ad09667be4f1d6ecc49dc6f28fcc471c8ec385b7f11ca2511cb2ea2cea9b89890661a4b5bd2c1c9d2cf49e516dc5db7f
-
Filesize
203KB
MD5f231a0f2940b4c3fae6d887c07907629
SHA1cec6c7dc7cebe18ebf9ef7c773a681ee19bef7a1
SHA2567e1c7608b3a22e3d026c14ef87e7906253749163463e131e19bc5ea5144438a7
SHA512cf9f7fa36d556142ca12287f96d1a7afaef16968b74e9eb03eed33b032832cf553c15d074c6cf4486ab37735340e153eab538371bd4d5509f9d200ac71dbed97
-
Filesize
399KB
MD5875b3a0c4e745f55e82430d6d1083f54
SHA192c126539116366b6a7bd3b088ac27d733bbdb34
SHA256535340a092eb8723f45f3d088208a1d10eef3386a0ab1a81c9b7ea8036ef8dd5
SHA5127eb675652ad86707d82a8d1ed87246b3d3b92c78cd68d21d5ce45dadd58f3ead80a3ddada544fe14ca24aa36ba76e99099a3d7fb82250f2e21885659462289e1
-
Filesize
429KB
MD5335fa106a0aa9d0fee91afa8f2c8aedf
SHA103efb56a662d3c1ccb6bed196c0de1e1bd25964d
SHA2561343410da7cedbbf41f7fd6bcaae009901666f1b829085e237e9ff3151889555
SHA512cb636fc400aa631c2a1aba8f9168075d5a1df3b793e11c4e5e97348bd03dba611722dcfc4fce607c4e9256e68568a5fac5e0a3e56be1b6c4957e15f5c1ffce40
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB