Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10-12-2023 18:41
General
-
Target
85cfbfcea794e13bbca3702a13e879929096258fdd1ecf370bc032db537accbc.exe
-
Size
6.9MB
-
MD5
ab4a6d0e46b043827eb6f77be48f976f
-
SHA1
8e369dba74de6f20fa2bddd660eb065431e3d9e7
-
SHA256
85cfbfcea794e13bbca3702a13e879929096258fdd1ecf370bc032db537accbc
-
SHA512
170def1dd12e81df31879532fc05fed8812c4bbefc2abc8cc95729232664f185c1d5fe9c9dc76ad9e99c17cb5285c83e0bceb2c20e4b5b788463eb64bce11414
-
SSDEEP
98304:0Q+Vxb2IGx8i09D7OWCLPMTeQm5MT1k/lmrpt9l4Rx2UXwDieSC0kWppgK6TrzuG:SVx6OdDqWwWeQm5+kYrMCUX6m7y5Trzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\85cfbfcea794e13bbca3702a13e879929096258fdd1ecf370bc032db537accbc.exe"C:\Users\Admin\AppData\Local\Temp\85cfbfcea794e13bbca3702a13e879929096258fdd1ecf370bc032db537accbc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DK862.tmp\85cfbfcea794e13bbca3702a13e879929096258fdd1ecf370bc032db537accbc.tmp"C:\Users\Admin\AppData\Local\Temp\is-DK862.tmp\85cfbfcea794e13bbca3702a13e879929096258fdd1ecf370bc032db537accbc.tmp" /SL5="$B0028,6990755,54272,C:\Users\Admin\AppData\Local\Temp\85cfbfcea794e13bbca3702a13e879929096258fdd1ecf370bc032db537accbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5a7135045d4ced3eb5413a99e4fba2f6d
SHA14aceba94166933ee66eca968f99d46836d86eee1
SHA256c67d5980b81743a94bddfc64d87d3c0acb65b491a4f0083fdd57f1a01a36a796
SHA5126abd55b0e67a66c7d1683fa8e2aa75ce9ba1a55812cbbd186a17aa8d111fc60521b5843bd398d422c235398a7e1ad2efc7d72ada813fe1f59c697faae8e4bda9
-
Filesize
47KB
MD528ef2afdad9b83ccc3ea5fe282f09825
SHA150649acbd7fd85fc3808e5225e300feaacb6bf57
SHA256a21ce29a80a0067f1b0a2c11db36da60c4830ba976a21f32e946c89acd5ac01c
SHA512038d22a574cf521f45293021d2a472b477adabbfa0cb988ba88f0598ddf9f3ba69819e2b3b00b703913a9e10fc3f3cd34987a711645560e717c1e7fb69a17ba8
-
Filesize
378KB
MD5146e8d1000e66d4ed2bd53a356b9ac2e
SHA1fc3ee70aca5edb84f8fee4f8f6cc1c4ceed2ca2d
SHA2564c3fed25cfc05be6f071b0fdeb3b02fb25d52b5103f28d5335856fd1f8bb472b
SHA51267aa37828ce303ecda4d44902104ee72d6aa9f4257bb578d09f10d0746ca106ad71ab356c55d025d8a7151e846f815e074ce1a74130b60d03c64f203a6b91ccb
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
265KB
MD57598e9b6f37d90f962af08b6781f9c4b
SHA1b8c061813b73aa180653d6966159171c9e1b8448
SHA256749cc007e64bfcecc3b0e759f88c7bf76a10320ab83bc6790760bea6d0967dd2
SHA512ced5ce5e7ba4b7d083b7d5038ec1042927f9ca92073f03d3aa46db5e53bb113e5f08f5e190962455f004934ff9cdd7701fa301a7e51d8c53cb5797b004f762a8
-
Filesize
229KB
MD5b469cd9dfe87a219483deed7ac35b30c
SHA178722aac65bdeeb09215d03e1cff042d11210590
SHA256a814f5cafd6ea60e61584b466d4d97b941136999b45663671085e3e45b1894c4
SHA512d79c99de65733f0e018b500016921a4958436283db191efdb895a0ba4530e3517186fb4b33f1bab655d904ace4c83a29e0973231f169f03440b2b00621801649
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB