Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
10-12-2023 20:29
General
-
Target
4f8a5d33b1f0d226ca0625e27f517ad97ceef0d0abc1fe46e17cb0d6d3715992.exe
-
Size
6.9MB
-
MD5
47460621604e6140e1c7f7a0c472381b
-
SHA1
88295f1d88394b6c4c03e3e93678200e585ab8cb
-
SHA256
4f8a5d33b1f0d226ca0625e27f517ad97ceef0d0abc1fe46e17cb0d6d3715992
-
SHA512
5a829c890154e6ed0980267543a2e1a746249bcd48461d99e85b16167cebfe891ef97e538e7dd3531b2e324cbd28c60fe758959d5a29045dbc63d29bacfb9ee1
-
SSDEEP
98304:v+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:2z25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f8a5d33b1f0d226ca0625e27f517ad97ceef0d0abc1fe46e17cb0d6d3715992.exe"C:\Users\Admin\AppData\Local\Temp\4f8a5d33b1f0d226ca0625e27f517ad97ceef0d0abc1fe46e17cb0d6d3715992.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FQPAG.tmp\4f8a5d33b1f0d226ca0625e27f517ad97ceef0d0abc1fe46e17cb0d6d3715992.tmp"C:\Users\Admin\AppData\Local\Temp\is-FQPAG.tmp\4f8a5d33b1f0d226ca0625e27f517ad97ceef0d0abc1fe46e17cb0d6d3715992.tmp" /SL5="$901C8,6985375,54272,C:\Users\Admin\AppData\Local\Temp\4f8a5d33b1f0d226ca0625e27f517ad97ceef0d0abc1fe46e17cb0d6d3715992.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154KB
MD535ca1f839fddea4d0b33dbd340d3e42c
SHA120ee9b8cef254dda0a878d28650558b405ca33a9
SHA2564d93075c7408f2e29814096a18cc2d59ed1321429c3d9f17f1f749688e9e1576
SHA5123d46fab4bbb296eb8955b60e845909f87b5f08e17c2a1a06d42a2e4c880f977131c089551a8eaf230ded6fa972b447ef8d59bc67f578e2018d6301caa3c3ac76
-
Filesize
78KB
MD549a77b474421c55b8c0b14b7bdfcd425
SHA110248830b167f1f97bb6605263281e7d44436168
SHA256864c5ef4a537de2b02f4cd1e3111d2768af93ffd599e3cef2db9dda719a935b5
SHA51239e01e0b3d86b217320127620cfab2229867a38cf4021f9ced52bfda2c06a7d4fcb3c30529785ff3a0137eba45921c4e94ee9120909b7896fd068d9dc597d02d
-
Filesize
25KB
MD51d212f51425437f1b43ff4200c00f3a7
SHA1cc75bb5250ff96fcaf7fd635f13470d1c82e4be0
SHA256e302028fa80e99cb6eacce136f83f30343e908399d1a604007c92b65d8b14cfb
SHA5125d6811d3a6704e0fb5e1f13b2d538e61737bf67da7154a5347af1fb901f89f30432ad911c69e328f07400659c6f8db250503d812e56346e67711c9b2a87cb105
-
Filesize
294KB
MD5c836095bdd53a28812b7807f4e73b6b9
SHA159c5dd197a849c4cd5f327b64f72aa3097ec9960
SHA256f97236ba7b5db817ce7bb85866282e589f6764f95f1d940ab25432be4fc3d7fa
SHA512fe69b4bd2fae161ae255b08754f3c42643ca5b25762981041a8ef60b676386496ba5406c25d9f7bc0b2b5c92564dbfd9e4ecd64e3ac0f597faec769bd3a0e0c7
-
Filesize
182KB
MD594b40bec5a493e95715a435d7d48dc1b
SHA106dfd2a8fcb5642fba804facce2a5291adfdb640
SHA256c0189543c86212056563c856b7f1b7aa8fcfb67d4ac118590583e99e6fcb0ebe
SHA512214c789871c4f7ba58169c7af0c50d1e35bc7d5464f7defff5821d30b58cc6871b9d387225879dd63580f578000c784daee2b24cdcfb9e2c2c77fb635132b259
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB