Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
10/12/2023, 23:51
General
-
Target
ec2a042762bc2c49ddaaf296b12514f644a75678bbca7af437cd8f12a466b667.exe
-
Size
6.9MB
-
MD5
f6c21e0794ebb3c0e2e4fbc0f9762399
-
SHA1
008581e0fca606d12c1db14a0dc7867b49d46e91
-
SHA256
ec2a042762bc2c49ddaaf296b12514f644a75678bbca7af437cd8f12a466b667
-
SHA512
efba5b690c7dd6cf13fce989504e45c03fd96e79310fc91bc332d42f76f45520bd673e73617b3da1ec7b653d947d6bc27c851df874b1a72233ce15f8d3905310
-
SSDEEP
196608:YxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:QNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec2a042762bc2c49ddaaf296b12514f644a75678bbca7af437cd8f12a466b667.exe"C:\Users\Admin\AppData\Local\Temp\ec2a042762bc2c49ddaaf296b12514f644a75678bbca7af437cd8f12a466b667.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HA5J1.tmp\ec2a042762bc2c49ddaaf296b12514f644a75678bbca7af437cd8f12a466b667.tmp"C:\Users\Admin\AppData\Local\Temp\is-HA5J1.tmp\ec2a042762bc2c49ddaaf296b12514f644a75678bbca7af437cd8f12a466b667.tmp" /SL5="$8020A,7025884,54272,C:\Users\Admin\AppData\Local\Temp\ec2a042762bc2c49ddaaf296b12514f644a75678bbca7af437cd8f12a466b667.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
329KB
MD59599cdfc29635b2a83fd34363527b71d
SHA11cfa9e2977fc81b7fdf398fc84951406f042535c
SHA256469065e4a2d5fc6d99d316b4d31dc189da810ff28b51e4c919d8bf7c91a33be0
SHA5124b8ed6b08de0d24ee2770e3198829e78df739cd1b8efb6a9e2c6bddcb73f9e24acc79cb5d0ee6f452ec56540e65b14d194e326d65e334303c69f12e95b3a950f
-
Filesize
331KB
MD5387dd193cd6f4d9af2c76f198118a25e
SHA18fcf720674a0f2c8962360b5319014a92845e9b9
SHA256e18f1e5b36d1273c96e5172b0dbc040b43ef540ede370d25c0668c25d89b53fe
SHA512aa9a9fc5fcb90c3536b65f28a64de00937e9c5d7817d2c73f86f67af67b52e7be2143b125a6838863569b467ce0399da19b688153374c4ce4a614cefb61f87b0
-
Filesize
531KB
MD5d41e7aa7c2833c45c8bb47d9a13fbeab
SHA1325011446c9545fa73724744fe442871a161efc7
SHA2562395ffb77374a71cccff1879b0cd0b58b4827a15c5c2eae07094f1cec82333c8
SHA5127595c4200ae39eec04335f7a492ddc0e3113c898468878eb776b4d23afdd2b4f5cd3162a84f0e5b8b6456c539d427f0f971265cd0e5c9021b8b859c138ddfaf0
-
Filesize
83KB
MD5c8f21e3cc76420d6018a11f32fddfb2c
SHA184bbea9f6707d0228991e61e5121d51cdf480d57
SHA256967347261e2f9df38ab7d5b8e4b339f8144a85c7651db17f9febebf8ca9ca7b3
SHA5120afa6d76ea3a2e2d7dd738091460ba3e1a608febead8de241d0ad649861d684f3f7a7505f68ff6776d029d8623d3e4a7237b293ad89100fc31b09c98c52135f1
-
Filesize
104KB
MD50d769aa34e9bde1b66d811de92182351
SHA18dabd30100aa96d009244e25e1bcb9ffc4c3a2dc
SHA256a6425f2b0e23306e677baf41fa382da0556505ac681584fbf21c38bedcdd0169
SHA5120cd263851a7ac8a62bd20b7a55ec19ba29c5bc33e180adaca6cab28ecf21e52d5938639a7ce8dc319c60e294d8a7010e4f8e559a9abdb62b847afad50011fbbc
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
14KB
MD5cb6189cffe0b066a76fa0e97e15d8e32
SHA1019cd50a79cec6f14e6d22cdca086b65fdb53e64
SHA256994ccb5364a915ce579b529a6986fc191c1ae9ed69504b3f17e72a8cf9901e94
SHA512725826c10583c15a3014efcc118d268e5419597d0d9c0d23511a9070163ec4887881c9a3456a78e13a4c9aed54600374185f02469d98788c6d2f20d9292c6d68
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB