Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2023, 20:09
Static task
static1
Behavioral task
behavioral1
Sample
6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.exe
Resource
win10v2004-20231130-en
General
-
Target
6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.exe
-
Size
6.9MB
-
MD5
8c16dbf651647935b04f0b5cbbcea063
-
SHA1
105fd6efecd1a8f0c2a61a40d22d1b0e46886148
-
SHA256
6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577
-
SHA512
a3a0304fda63f290dea86968ff6dff012ca92073181e5905202ce79292dafb65a0c3023e905b728a1eb35d96a559656dd0fc227709bcd8c4c9335e055f92801f
-
SSDEEP
98304:M+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:Vz25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 3268 crtgame.exe 3252 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.155.250.90 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\is-FDO7Q.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IFGNT.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VH9A7.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-E9NRQ.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LTOAG.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-T1QLH.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0HH4J.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NP7NK.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RGH19.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LLVJ0.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8P5NC.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-V1K23.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-M1AJ0.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RDHGT.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-2PAMH.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-K3R03.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0OV11.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0J3FH.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-57J6M.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-F5IQ6.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-F3089.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AHQNO.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DSPDH.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-000DU.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DSI17.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-N6974.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CO8NB.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JENST.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RL4CU.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I0H8G.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AMO4F.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-HNE58.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-1J2GC.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BKPUF.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-1R699.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-BTBE2.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-N0KD7.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-9V52H.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6EL88.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-9S0DN.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8S208.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4BB3D.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MGEHT.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-HLHD7.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GNUED.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9MFAJ.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-M9J37.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DAKIN.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IG9P7.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JTJUA.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9P9EN.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0J4IT.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\is-G9VII.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7OE3K.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-EIJPI.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-FFKRQ.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UI364.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-T6F92.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GBDC4.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-L9A3B.tmp 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3908 wrote to memory of 1580 3908 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.exe 87 PID 3908 wrote to memory of 1580 3908 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.exe 87 PID 3908 wrote to memory of 1580 3908 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.exe 87 PID 1580 wrote to memory of 3960 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 91 PID 1580 wrote to memory of 3960 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 91 PID 1580 wrote to memory of 3960 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 91 PID 1580 wrote to memory of 3268 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 93 PID 1580 wrote to memory of 3268 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 93 PID 1580 wrote to memory of 3268 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 93 PID 1580 wrote to memory of 4852 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 97 PID 1580 wrote to memory of 4852 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 97 PID 1580 wrote to memory of 4852 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 97 PID 1580 wrote to memory of 3252 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 95 PID 1580 wrote to memory of 3252 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 95 PID 1580 wrote to memory of 3252 1580 6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp 95 PID 4852 wrote to memory of 5108 4852 net.exe 96 PID 4852 wrote to memory of 5108 4852 net.exe 96 PID 4852 wrote to memory of 5108 4852 net.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.exe"C:\Users\Admin\AppData\Local\Temp\6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\is-Q6BPB.tmp\6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q6BPB.tmp\6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp" /SL5="$A0182,6985375,54272,C:\Users\Admin\AppData\Local\Temp\6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:3960
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:3268
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:3252
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:4852
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵PID:5108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
278KB
MD58e00b6032013dc180520eb639d0442e1
SHA177293cdf931d7f122c803c33f3c5931c60ef586e
SHA2565973e1f649af2b33893e70567128c9281d26dbd7cd2a06fc6c5fca15b9027ff2
SHA5127e78cd36c0748f909ed056744ac353f3a1395a4a06acdaa9eacb9605046eff1a9f916817b2d2121e3f9c588759a9a14858e1bd0a5e31cb72328e8f2fa5011b4b
-
Filesize
618KB
MD55c21beb3f3caccc8903cc97127d3aaac
SHA10bece717e091ec744bae060ef796bd5ce7d3b6a4
SHA256f1291b8d8e8a674fc1fff0e72a04c1a87420f9b9d31ebfc913219c0b2085e357
SHA5120c872781d15bd7c70b4db33eec63fefca4c79320d4e84ad5f0a9f93467ca368199b96b52c6109ea166dd91cb195838f2e06ab58b2b8ad1232de6008e1e7c8338
-
Filesize
346KB
MD5c0dcea847dcae82c42fb1874cdeaa99c
SHA1f05bf04f60eb25b19f021f90ca1a50226ebc1bf5
SHA256f5e23788666f03f0edeffdd098d4325ff9bbca64a59cbb1e6d257b3719874dd9
SHA5123909526673e67cb1a964d4807094c0645ed325bf996824314157b396dc27ed755aa84932774ced6ec1faeefb839493527d51a9ce1c552626a71a7e23577804da
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-Q6BPB.tmp\6da906d191d16ecc9b70ac15845f4a7ef0389ae1e3b628602ca15ebddd886577.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4