Analysis
-
max time kernel
144s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
-
submitted
10-12-2023 19:29
General
-
Target
tuc6.exe
-
Size
6.9MB
-
MD5
67bbae73a4271163085c7b08d4b1bbde
-
SHA1
1c0114d37ce00f22d5fbe4af01820e82f661fbb2
-
SHA256
9666d4a6889d32d2e3daa0dd67b1a9c3255fafa1325c45c05894d291ce6fcccc
-
SHA512
5864c0b158c72e779b69ea20f00bae5f811c4046a9c8362bae818786500af81d16dd76eab8e3a852893ecc6deeccdf082c8b2e6bd1b5e8e44568ff528bd08370
-
SSDEEP
196608:xSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:xSjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc6.exe"C:\Users\Admin\AppData\Local\Temp\tuc6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-M1U3Q.tmp\tuc6.tmp"C:\Users\Admin\AppData\Local\Temp\is-M1U3Q.tmp\tuc6.tmp" /SL5="$70122,6998999,54272,C:\Users\Admin\AppData\Local\Temp\tuc6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD53f7494751d271c51875f108721773270
SHA10ba84a038f096ef98dfdbdd8eb7257489abb19e2
SHA2561e42cabd32a79c5ddfe72f53606a766a7b28e687cc4829b1d64b2c09f07e66d1
SHA5120f3e21fcb0311059590e97a375ca6a8558f73933453645dc4dcd820f004d0021bef8afad4cba9b899ededda8f50559534eba6aa6222a439ad0c477bf6c5d4d87
-
Filesize
328KB
MD5cfc24ebf5f9733851cee2b0f66d42e03
SHA1aaf00b8250bf099bd7ea7dd054a388c141b0545b
SHA256adadb86c391619a02d01e844d858f9c944b167dda19adb463a307cfe0ccf7d25
SHA512188c9db636e0b60dfa32bb7fe7a57a08efcc60a37ca91cc2bd974f41cbfc525c04ca245586a9ef679b7d6d413224434e42880a6da6af810a3158ff648eb2dede
-
Filesize
27KB
MD5cfe8c2a0169189c6e9d9bb1be6cce39a
SHA18ec9fce87fb48c2a12a598f3d645567a8b577407
SHA2564d9a5598fe6c8426f6d19992c227f40fb60b4a33449d9ce861e5f6cc9b660091
SHA512e1ec58c5b9acdea19c6a41280b8540eba88b239995e329f8516e7378a0a2b6e378addaf591c33ab69a99959a9240f1caed8934a7eed9adb5cb829c5709aa8dc5
-
Filesize
61KB
MD547f352ecadc26baf8e88c628d28cc1c8
SHA19ebd988747fd40b2d6080f4221ffa53be8c3d38e
SHA256c1110028aa612f05d9d4f67b943cc358cc6b71393de300b1119d659a9db50928
SHA51282781a2dfeb50b1cec248977426d44a43c7f94350fd6c513249ab51118fe7d659ec3a57500b073bc480d5a5b93188afd2ecd5657eaadfe3d2ea031032839c88d
-
Filesize
147KB
MD5937c27d2b5651893ba642b978b185e55
SHA1b62f3ca2e09dbc590e138963a84071c959f04aca
SHA2567ce6168598cf6a8301684288c31db679df91deaaa4f3460b14977b7802c9c124
SHA512efbbeb83d0a00a3e01902da7d6e30c558721055eafdf949ae0d5683c93daedda4b32a5b01bdf37e705b60f806b7c17047446756a7bd3cc2dbd904925612b7b91
-
Filesize
285KB
MD5752c0ecc846686fde176099a444d446c
SHA15d48272ba5a826c117a69f70bff2668485692637
SHA256c83f22a25eb2c701a1baa3d5a5a66b36e2a0fa61c46fff1e8fe16e48000e616d
SHA5124fdb614bbf7c7cc0632f24e3a1334251d2c78924004a01eb7f2e6b066c2682711f4d7c9944fbbb33f6d7dc88ace5475cc235525dde1a53bde5c3901ae785fdb7
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
162KB
MD59c5412873317c63a45bef28aa2efe1d4
SHA123205be5a67541703223429e828f4f1e16f8dd31
SHA256255f0fb8318064151ae07222f3c9a83deea610a25c9ae7bdf691135450a2e431
SHA512b4588a231f7a7fefb9aa9734432b5c59aa04efa053a7d090fe69a2a0766230820442c6a189586ea3fa460d7255454d7e1e904bb92ea93021db66055d91c378f1
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB