Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
10/12/2023, 16:36
General
-
Target
4149f6406133b136243c0a8f24e0425ccc1ccc7ab04772d1def7ab226910e02e.exe
-
Size
6.9MB
-
MD5
ab3bdc088006483299bc90a23b0ebdc4
-
SHA1
2f47111bf45cb1f22acc103736ebcdbabcb59503
-
SHA256
4149f6406133b136243c0a8f24e0425ccc1ccc7ab04772d1def7ab226910e02e
-
SHA512
0d5488ab389fcd6ec138faf514d5672eb592ea8663aa460705935e23c777e5606040105f1b299d58f413d0120ff9f76da7041868edaa871d615171b5fb409578
-
SSDEEP
196608:FxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:7NztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4149f6406133b136243c0a8f24e0425ccc1ccc7ab04772d1def7ab226910e02e.exe"C:\Users\Admin\AppData\Local\Temp\4149f6406133b136243c0a8f24e0425ccc1ccc7ab04772d1def7ab226910e02e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-O40D0.tmp\4149f6406133b136243c0a8f24e0425ccc1ccc7ab04772d1def7ab226910e02e.tmp"C:\Users\Admin\AppData\Local\Temp\is-O40D0.tmp\4149f6406133b136243c0a8f24e0425ccc1ccc7ab04772d1def7ab226910e02e.tmp" /SL5="$5022A,7025884,54272,C:\Users\Admin\AppData\Local\Temp\4149f6406133b136243c0a8f24e0425ccc1ccc7ab04772d1def7ab226910e02e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
305KB
MD59bee59bb5a8756a14202fa5f942449f1
SHA1a87c698d30bac301ca3425f06790dd75ec43a2bb
SHA256eb26164e15d902c86e99235f531e99be7d853a8ac7776ae88e13a37337b98ec9
SHA5122225e75001776c6590f8ca2a69f1e868ff701a556286edbac9d974d406a9b3b3fe033ec355e56b362898245127d3c388ce4ffaeb63626e782319aa8672991fe0
-
Filesize
292KB
MD57cb7f3d90871655e0d153c41706287f9
SHA1ea81b2665a5b74e3b4416dd895f815187d24f286
SHA25670953b86a9854387232102041037bb50fc1fc96de52d2cdda1cf67dea11c4ce0
SHA5122ef2a829bef97abbb41f94159cedd29a9e48b71fd029b3712bb8b8114175012a0a69361891ad522b554b87ca43fc9d4dad03ec1c5b4b7a28a3b76e1b77642f16
-
Filesize
374KB
MD5f05c81800461fdcc98e8f14d59210726
SHA12ee394c603a8e64b1140a81442783fac22c63b19
SHA256fb29d517f9cf8998aa3a115e290a6812896ce5b2010946e6733be114d805f54a
SHA512ef3470efb144c8754ed75c83fa5b40cfd29be68f85d4c59b04aee327a256cea0b2df99cad6f13a85b9400342f6ac918aec05fd41e006a88cae447aaf8d112b83
-
Filesize
485KB
MD585d4fd1ded05dc10dc3e308d19469715
SHA1bca19090ef4af9086f9497d780f3f10b3c0d356a
SHA256decc457282b902369a36486fd074a7802ebffc2eda74eabc99c533f57ceef2e0
SHA5126faa9935b6e466ec1f0483a400c6b3975bd0714d3fc88f676bcd61da11c467c1eda479b44b74fe4690199124fc06d0e75152c88a0b988bbf8a302af12156f204
-
Filesize
57KB
MD5daa8f0c49eeedb2e033f4639eb8f2adb
SHA1034e8c34571d0a90ad2770f008060d7ab4e628dc
SHA2561c704be82ca3a20f35ded437fae7cef4e152ffacccdadf9319497fce139ac49c
SHA512254be354116daac7968a3191c8cf12c02ca54961830f5fc4f59308e4db2c085956c3df3bd8b5c5a8e9beccab09db6cfbc74fed5d041981982bedda54ff534d22
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB