Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10-12-2023 20:29
General
-
Target
702b5c23ca7ae806da704f0dbef9fedbf06a22c2c15ecf931fa582c231fb93f3.exe
-
Size
6.9MB
-
MD5
9a539a2585fa6fa4207f09c189b24324
-
SHA1
2fd2dbaf005006de9e24d5361d9561d8e7f84c18
-
SHA256
702b5c23ca7ae806da704f0dbef9fedbf06a22c2c15ecf931fa582c231fb93f3
-
SHA512
f6c9e7b966188314ba0ed564e8c04485cb99beff1a4435cad3f5e82228ca11cee30ca00b6f0f771a61cb6b978d99248b58b64654325831c0e762212fb096fe0e
-
SSDEEP
196608:jA89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:nBmakyVnlUQ7Wz3Tv1jNTh0zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\702b5c23ca7ae806da704f0dbef9fedbf06a22c2c15ecf931fa582c231fb93f3.exe"C:\Users\Admin\AppData\Local\Temp\702b5c23ca7ae806da704f0dbef9fedbf06a22c2c15ecf931fa582c231fb93f3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-POA2F.tmp\702b5c23ca7ae806da704f0dbef9fedbf06a22c2c15ecf931fa582c231fb93f3.tmp"C:\Users\Admin\AppData\Local\Temp\is-POA2F.tmp\702b5c23ca7ae806da704f0dbef9fedbf06a22c2c15ecf931fa582c231fb93f3.tmp" /SL5="$5011C,6977575,54272,C:\Users\Admin\AppData\Local\Temp\702b5c23ca7ae806da704f0dbef9fedbf06a22c2c15ecf931fa582c231fb93f3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD522a59130d563e0d3335c05fde42bbd1e
SHA1bbedeb8fed25e9f65aabda67f58d2544dc62642f
SHA256f17dab7038acda46e1c5ec3ab6cd927e68dd61b530cf77bf3a442b3416c2aaa6
SHA512f441b410948f77e9ff8389b7cf764f438229aec8abe5c1a3b8c560c0966a95bdbc14150a75617d440b176ab752c61707a25e953286a56db121f793a65f5bfc16
-
Filesize
171KB
MD5e6c2699ee1c5749ea3515069eca6320b
SHA129d29ec2d2044fb090a103c9043b1670ab3c7297
SHA25693e85119965625f99dc0fc6543ef5416608dbec7ebb4bfc85966fc9c31c8045b
SHA512bf2cbc8b675a2dbc44ca22bcaa665c08ef4ef012e1f89662dc16ac0de10754c3aaf169c4de6acf47622d54e72f047bbefa2d045f84b0989b6bd8794a39653404
-
Filesize
91KB
MD5fb28b9b7e7503c27b38ff9f35a6537b0
SHA143e8cc1657ee247dadf142dddb2fb1ffcd2528fc
SHA256e119fb8c65519a2652aac687fbbe8b75083784c61447331da796889a9bf6c62f
SHA512932fcf3f9d0613c33fddc00f319efe41f1f415dd2bf5a8bb21502514ebbe800eef80eace1a02877ceff7735791dddea9be3f0f0dae65c75540de4869e98be6c4
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
126KB
MD5ee88e8371509aebbee0231d039b0e684
SHA1eb0020dd6f10dcd5ef481f9f61c7bfca7b113458
SHA256146348492b020b755c5162cbeb11dd4bc36afb74a1beffab75d1b46833a2bee6
SHA51261ec9953b4ccdfadd7b988b1a91348200a18e44ff834b191c8c583af970fd63a2e58f29a0fe3b89646097567a100964237d0c572354f5356ebf49ca882ea5b59
-
Filesize
76KB
MD5112a56a174792a6d2acb73a34b5af601
SHA1c03a2f3a9e8d5046a6b9ed6b6bf09f195cc9b11c
SHA256d7086f6bba45dbfbedf3345fc3be73752f320baeac803937f491253834fa487e
SHA51209ed0bc53d0c3c2250e3ad6caf63c08093b4b5e3553fbde05a2df53934470e1731079b6ea463bf40e0bb4212b58a518ed509b218b040adc5b0f64cb5f2828098
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB