Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
-
submitted
10/12/2023, 18:33
General
-
Target
8a6d3e1afa09105a445e7f3d1401fe0583ebd0ebccfcba2f53154b84578c00dd.exe
-
Size
6.9MB
-
MD5
cf28219727eaa9d47fc746f88bd460cf
-
SHA1
301b0b1274bcc0ea0c8c3962176d26e36aebb1f3
-
SHA256
8a6d3e1afa09105a445e7f3d1401fe0583ebd0ebccfcba2f53154b84578c00dd
-
SHA512
2d24360735311b82226c9de1f9417d39a07a97595a758ab2c03cf0c1fcb4e94e66197c9afeb8c80f00e0a6cbec40ce415636ec7f276a274031b6e796ae0554de
-
SSDEEP
98304:dQ+Vxb2IGx8i09D7OWCLPMTeQm5MT1k/lmrpt9l4Rx2UXwDieSC0kWppgK6TrzuG:rVx6OdDqWwWeQm5+kYrMCUX6m7y5Trzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a6d3e1afa09105a445e7f3d1401fe0583ebd0ebccfcba2f53154b84578c00dd.exe"C:\Users\Admin\AppData\Local\Temp\8a6d3e1afa09105a445e7f3d1401fe0583ebd0ebccfcba2f53154b84578c00dd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-92OQH.tmp\8a6d3e1afa09105a445e7f3d1401fe0583ebd0ebccfcba2f53154b84578c00dd.tmp"C:\Users\Admin\AppData\Local\Temp\is-92OQH.tmp\8a6d3e1afa09105a445e7f3d1401fe0583ebd0ebccfcba2f53154b84578c00dd.tmp" /SL5="$401D0,6990755,54272,C:\Users\Admin\AppData\Local\Temp\8a6d3e1afa09105a445e7f3d1401fe0583ebd0ebccfcba2f53154b84578c00dd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD560d058abb308e5ab23a4cdb816a2deda
SHA1a61fda08c74f7cc7b8b8557797a151434cbc7b81
SHA2561dbafc19c1687bd2c4cf46c4c5ee12a7c24b05903f458f168c617e65c81dd430
SHA512c5071407d45f5e96c74a1c9a2ed11959646cfb196c6bbdb4701e1c51a5172a9b3625fd062bd3f21a8b40fc72999848b179ff88e736e986d77334428471d65d40
-
Filesize
135KB
MD557d24745743b3a51b1fd762ad83cf82f
SHA151f7169e2c4adab2a6c939f7b174e89da6402686
SHA256080f256ee8e3cc726bf4c602e5738b60543745ef513fe4bcada7e4941412638d
SHA512d6e0fa64fa47286b423fe0835391b3d13676e382ba4d93e32af57e2de548f83d0e64cde047fd09915aaa854a8c14435e03cd51b7edd589e80faf924dc0736087
-
Filesize
248KB
MD5412ad605372738f0238f260afff1464d
SHA11fd5140bfe80d7d12635cbf674dfd6e2e79fd758
SHA25698c66fd242e876931d2f7eef84ca74950ecefd4f0618517bdc94a8f8e52c3dd8
SHA512150560a1352f79ae267eb624c3d038bb4505297ebdba08c9521c392dcb9ca726708a7134c8f46e8deb273ce39ca8e74dce7b1fe9fe589743d6da25afa9496db1
-
Filesize
628KB
MD5c6ad0796a2e4d959e4ae8ef3996483a0
SHA1c024322de310190695225dde26b24ce35f17f5c0
SHA2561652b1bb5b279ebf38147815906d8dd7d5b72da5bb9e2b1b81b4500b85ed4bf4
SHA512df1c4b90e82ae7e8d6d77364f60004e96088152284926dea1540484097264c838671cd12aa70f8666c8eb343013c87984ad10b5d0748f9f21c7588854d646946
-
Filesize
450KB
MD56dc53af40e9704e883873eccc5a92cba
SHA1708f557c57797b2d9b3c189555c626e21628ada9
SHA256b9b69b06d5c5c8ee767cce9676ec22531f2cf1e6bdc5e17b4863b2724bd7da96
SHA51238b4ff814139fff85c498fbb3bf1dd05dc0ca61e9b55f803b6f801ccbaf22c2a71b5cbf1388f9358254469419069504c2df5bd4dce0f4ea64931654a3ff1f3ac
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB