Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 18:16
General
-
Target
tuc6.exe
-
Size
6.9MB
-
MD5
b24c064db81630bebedf3c614958baa4
-
SHA1
3b9bc009c62db36c5537727b6d023538221706f4
-
SHA256
86c4d7ebc05202eb9bfd3d8616b86944e0423e75f98a955edd1bf6db7542c16f
-
SHA512
a27ca37601b3e94eabd38f74df01778125478040dbff93b1d571989a71cc99b228e5445a1702914aab341b4202695af0fb810e39c6f2b2916ee9fc55461a090d
-
SSDEEP
196608:SSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:SSjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc6.exe"C:\Users\Admin\AppData\Local\Temp\tuc6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SS9KR.tmp\tuc6.tmp"C:\Users\Admin\AppData\Local\Temp\is-SS9KR.tmp\tuc6.tmp" /SL5="$9014C,6998999,54272,C:\Users\Admin\AppData\Local\Temp\tuc6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD5f9ad6e5094f6292e1c9adc190af7cc8b
SHA19d6d39ddf5de35c6058ba5ddbae0cc50a66113ca
SHA256daa99510a6ffada65cda7fbc2861cf1e02f82ec054f288028b7b1cc0f91aba43
SHA51232737aa56cc9192ebca4d22f6d87ec7befc1937a5be563650c281072dc912627ef5ce867bfd01659182770857855d3823970511776124c1f832677abda16070d
-
Filesize
138KB
MD5f697d42a245400088a4fbd69f2b9b8e0
SHA10aaa5a124fc3acbd5b78fb647ef0972d41512b8b
SHA25692718bf705ca3f6befd660d2048d5de2b6deed8003491ff6a93d4f5aaa907327
SHA5123f59b00a12d54f67b011eae692ac93bba993171c8dd0e2fd7b9766ba43b577079d93a78101bed13b08ce2d161af9fef3610d6dcf7036491c743021985d19975f
-
Filesize
94KB
MD5155e0aa4c58b1ed6ad9fee9c52d02844
SHA1b171780d924e3e33ba90f10960ad19af6e800aaf
SHA256e5773c1b0d729045841af84b463a4f184f95c749b4b959e6fd1ca41eb005cce0
SHA5126f14e90936f160d8d8ee3f85922981ba1fb5be3b184908abae11cc6fef597b9c2110b0a0f8d9153c80cf4e536561ea135ca203be28ae732edd23752179c4908d
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
324KB
MD5188130a32757ae88cb01aa9c7f227fe4
SHA19efd5577bf2df6e42cffe70c1fef33f079bd0b5f
SHA2567b9001c3fb15267cf7117b1f348d6872cfc634b2e95f6b48961f3e63159ee891
SHA512939ebb5d3f8492877542a7ba8c9bf1fcedf738a90b0f94ddc449932346f4be3ba1d5332dc50ceaa63282fc3d4ebee25dc43b334a660aa3e471e480fe8d3108e9
-
Filesize
297KB
MD58ea6c3d9c05357661d1f76dc9614b6b6
SHA17604e011f79f54f422bf1e6998c01490dca9ef52
SHA25698b6376e29d2e21af1186f18ab5456a6ca8fe235aa8d023522bcd906fe7c222e
SHA51290fd40c603316ee1485e90a3126cbf17b188aaca5c7809fb6f55ffa1318a265f5ad0ce4ac31588a57bb53cf9351e2e8afb23e4f5fdb6c13382ba96263a50f825
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB