Analysis
-
max time kernel
144s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
-
submitted
10-12-2023 20:15
General
-
Target
tuc3.exe
-
Size
6.9MB
-
MD5
f0f8e4290323039b6e8e03d06d4c2347
-
SHA1
65a9589c4cdbd0c8d08a0d46732e2b405074d4c8
-
SHA256
61b72c1df71bec3e8c2e3e047b2d5b6c41600447c16137611f9ff6837e7773e3
-
SHA512
3773bb662fa17e599cbd1939742282940be6969e0946557208b452f58459015a607dc257bcd10e7904e56a6a3b2519c27505743c3792b9f55c3491056bbe4141
-
SSDEEP
196608:/K2+nNevvWstwr2m5BmycyEbSfasepd5e4x6+AjZ6mjxzj:/DY6tiP3myRfzepXe4ny8gxzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc3.exe"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E0481.tmp\tuc3.tmp"C:\Users\Admin\AppData\Local\Temp\is-E0481.tmp\tuc3.tmp" /SL5="$500F8,6991381,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD57184e9bfc57c5729a447a29d5c3cba52
SHA18908538c59901e69ee157d1b2c2a94f26909c0ab
SHA2566548a3971db8030ce4cdb8b6e4bd26f9fed701e1aeed6deceae47d2c3d573d41
SHA5124a9b3d01b6cefc8e04b14d139471c49ecebf5d70cc219c4b7fc20398f08aa613bd00acf3809172d6ad27d72fb0ff82247a7c318473816ad49c87b11ed42c9048
-
Filesize
31KB
MD5d550a581a79f98018d858f7888450a37
SHA1bbf4d717f2bd16ca9c29f91483e2ba66d3aed42a
SHA2568dbeada64ac0fc3f037a1ad376d694a765f8b0e426bfc2cf46d3c887b5cb316f
SHA512df6303d73e704449ddc881b25e4b768c44f59b299e4fdc770c2408d42a3091eeadc23b713ffb40646c8e18881833a3006e06c40fccb7ab0f6950cec5eadc343d
-
Filesize
113KB
MD588e640ed61ec7315585875307cb2f46f
SHA134b3b5d9fa4e6a533ec1cc6253cd8d455a40ced6
SHA2560a7f873c2fc887284457a09be68b68d23aa893cb69d4858676e3a12e2c63ddd4
SHA512d13abdf39fc4426021cebeba2140d9477f85cc03c45f2e1541208567e61c700f630cf8aef80f9650a83b408e3839ad31d5fd34b671784bea4f53813b18134978
-
Filesize
1KB
MD514d083317674748d4cb8e3384484c890
SHA16b8c9037700f569ae228d1c8998b1d9faea21a48
SHA256199e49960b2cc64da68cc9822271d7a667112c42703f976d38258f8c83a78a67
SHA512f3d093902aa2d158e726ac6dfd689036352fdef5c6345941cc747fc175701ccc4e0215567e9620abfd17fa3f84cab07e1654957ce56c2fce4a6b898faf253de2
-
Filesize
31KB
MD5568e756bdf7105c212e508b41bdf6189
SHA1a2614eb6b1f10a67e25fa857775cdf45846f09af
SHA256990ac5122e9073d6c52b9f835fe9a0604ca775fea1ff85400f8c1b7a1557486d
SHA5122b97bb4e2d2615bc55b3292d9ab3eca1c1d403d1f6656728cbc366cbe235df54754d58e3fca4fb627bf786c53cad29e396eeeefaa8378c7233346e9ab11869d7
-
Filesize
41KB
MD558fdc8bcf37e0241b546d728d58866ca
SHA1e608b07812c8be78fe5febd789d84778f51bfc07
SHA256b6e25442da8c96c55cddb43285a58b6265a59a2b925a72ee45c46679ce45faca
SHA512e49ae7109bf173837f081421d5e6673fb834cb007bfe3649cf60f1f8a7b1b4633364bbeccdff7e81a6e7828e9815d97eb321b3a1bc80533184f5ad648a77bb0d
-
Filesize
46KB
MD5d1c7cf7686b5663ef6a0fa19e3d528ad
SHA1379d186df728426a83d1ea31deee13e33abf39aa
SHA2564f0c6a6da33cffbcc4ba74998aea9461129967bf4d8aaccbef85cbb25324df0b
SHA5126e322533a834079d7b9dc230ea79fc94d93ebdff621166af5ad5de15e45e619fda9cf2555188f4773bec63f190d690312ee65ed1b509e8172402ead1f88c4207
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
1KB
MD5b153f8dfe895cfbb5b3840e17257851a
SHA1257c80dd04f3e7650ce58856dc8d8bfd94b45efb
SHA256fcea99e38cf910dfbdf6426b70eb6c3e9de9035da07c6f458eb6e8b057b23ee3
SHA512260b16396738504664960e4287b500b84d770043e6ca8b841f1288bab913e20f3ad3cf3a16584ef330561419765d085b79aca30bfbacd0e75de3cba7556b3374
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB