Analysis
-
max time kernel
121s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
10/12/2023, 18:18
General
-
Target
7376e8e4197e5d4c36489b419f1556e45c8e9b5918e475c794a8809f0318c703.exe
-
Size
6.9MB
-
MD5
76f8c962f19a9372d8d4f976be3c0cf6
-
SHA1
89f17864cd8135efc32fa5191cae787bed5acf7d
-
SHA256
7376e8e4197e5d4c36489b419f1556e45c8e9b5918e475c794a8809f0318c703
-
SHA512
284fb92f40c315ab4ff8ed7539fe1217ac153a98205c0f9572087e963dab6f0d2457b424361cf53416aa55873676c80679fa59e370a62211f8f3b09f6282e0db
-
SSDEEP
196608:iA89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:qBmakyVnlUQ7Wz3Tv1jNTh0zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7376e8e4197e5d4c36489b419f1556e45c8e9b5918e475c794a8809f0318c703.exe"C:\Users\Admin\AppData\Local\Temp\7376e8e4197e5d4c36489b419f1556e45c8e9b5918e475c794a8809f0318c703.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-Q0TC6.tmp\7376e8e4197e5d4c36489b419f1556e45c8e9b5918e475c794a8809f0318c703.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q0TC6.tmp\7376e8e4197e5d4c36489b419f1556e45c8e9b5918e475c794a8809f0318c703.tmp" /SL5="$80200,6977575,54272,C:\Users\Admin\AppData\Local\Temp\7376e8e4197e5d4c36489b419f1556e45c8e9b5918e475c794a8809f0318c703.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
740KB
MD54b054cb5b8c381638e3c420b9ff7f183
SHA1af82058aa99eadc997f98af17c74b3371cab6223
SHA256fab684745bbaad6c8abe10370d939b5f23762ef068e7e12eb3ff71da00db978f
SHA5125fd179ba86856e04503357bcbfd9bdce8132295425dc65126fd19448d8ec8873810d36127e979019b51adc7c62a51e7b9724723257f73c2f68225a67a96baf7f
-
Filesize
1.1MB
MD55ce64e1ac6c619714ecd59940ed64558
SHA1079f9749263a7bed196e52467ff34dcdcf6e8345
SHA2562584e6918aa4a458ba9cafc68c6520c4d436bea8800c7f8aaf55e6140fdf6a19
SHA5120fd881762c9caa9b60b062f5bf36119f1b3a8d591c9def55caa59102a784f7ad5ef4a5472261ca8d4e02064467148adb470ae10416f9ef90fc12753345929dc5
-
Filesize
1.1MB
MD5537b6d4d753d15a401bf6dff1bf04d9a
SHA147209ce08dc97ead75d6e5c4e497e13615d50312
SHA256f6d20f5a4e91c9c67dd3ee5f0b5f7291cfcffa003334318a90af48c02fa0ffe8
SHA5128c2072414c77ae7da11d5f3ffbf986d1a425d308635c9cf6e3bf09cefc2c14200ff3ec14ac4982be62d52b685740bfd623b082d44142e0232c2a8da0bd9bf708
-
Filesize
388KB
MD5bf91117b32b3107bcbb1a8e2c60e4efb
SHA11c8dd77f87f578b4a1e9dd7050e2d93256659935
SHA25660b712b868268a98c2c798212f0e5254424b4216402551d2b2a56676b8bf2125
SHA5126d2f6d1f960eee419d4f925310d3e7286e4b81b836147b97d1c32b7035640180a096a87e643591382023ae90ee8c4e396709e7fc47cf638933d045456d2e885d
-
Filesize
347KB
MD51ece6c0c75b519aaa06c14618e02936b
SHA1ddff73334c7cab54408f91831f771020beff82b3
SHA25611c1498261a6ba26483c1afd8e1cd6f3ae399a662b14f30289ed70b295680c4b
SHA512562152a8593f9134b6ca6a9a119114512d799a263567cc03a934c0e9eb8cfc1a204d260c2d1e9b89637ff15dc18d689ee4c9cce6ebeb1191b5680c51e73b9fa6
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB