Analysis
-
max time kernel
1s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 00:12
General
-
Target
22d408a42ee6f48bc2f39dbc03ae4c47643fb3849e918d1dca6c3ce03a34fa51.exe
-
Size
6.9MB
-
MD5
c5a4c04864914ae19865e6878e57c190
-
SHA1
b562c037ee8b6b09c5a707351824b2dc60ac24f6
-
SHA256
22d408a42ee6f48bc2f39dbc03ae4c47643fb3849e918d1dca6c3ce03a34fa51
-
SHA512
d9857de4c9222afc76228bdd812c760679d87ba7821f43fb15692896339d7bb2b3a876fb0c9e15e2a0a007a8a2dc9241e8e2bb1d894a1c06a3a533448d61841e
-
SSDEEP
98304:u+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:Tz25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22d408a42ee6f48bc2f39dbc03ae4c47643fb3849e918d1dca6c3ce03a34fa51.exe"C:\Users\Admin\AppData\Local\Temp\22d408a42ee6f48bc2f39dbc03ae4c47643fb3849e918d1dca6c3ce03a34fa51.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-A8SDJ.tmp\22d408a42ee6f48bc2f39dbc03ae4c47643fb3849e918d1dca6c3ce03a34fa51.tmp"C:\Users\Admin\AppData\Local\Temp\is-A8SDJ.tmp\22d408a42ee6f48bc2f39dbc03ae4c47643fb3849e918d1dca6c3ce03a34fa51.tmp" /SL5="$8022A,6985375,54272,C:\Users\Admin\AppData\Local\Temp\22d408a42ee6f48bc2f39dbc03ae4c47643fb3849e918d1dca6c3ce03a34fa51.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5d7bced2c84172e6b21e720a5bc54258b
SHA184db7abfa4180742df3b1a31b8a0641491a802b6
SHA256efc39ce91f743ab5ea03ce0a7827f17414b08e79593d07377d0aaf4bc18ae4b7
SHA512d4847d659406a34a371b597c673ad23f603847072bea7642ed65d85e72cee6aace34c4823c0aaf0dc6c74501ee625131db222e28721c5982338c835bfed055bd
-
Filesize
9KB
MD5de5ee1941fa4e4daef95a916f6ab82d0
SHA1d5fa7b7e493257627646e11715bbeee9df5658c7
SHA256a515ca26bde1319aa099c0f465c7a369527e186ee3da7f8747e2c81c549a1dd3
SHA512759d71c92fede5f98d0917e8ded2d045d5caa1aeb6caef085c148d9d4ec234ce7195348dbcc0effdfc3f1360d624c35c33a15a3c3e379db758c2d80a619aaa05
-
Filesize
36KB
MD543042573e4b16a7aab3f876ab2775455
SHA14d1b9e7c8e085fa17efdaf06ea75cfde0ee5dbe9
SHA256dc24bac138e0ae4e6d8eabef642a796c5756f916005de23d39146ccc61acf84d
SHA51266e770bc0d2496a85bbb03db78768dd06f2226e0b831917d7cdefd9028d889bdd17d53042c1b8016ab902cbf5f5636c897900c9ea4a115ca90f6034677d2f96c
-
Filesize
34KB
MD5afc4a140dd2dd5fc98a7a94c1d938d89
SHA1ad286a988bfe0c1a4773edeae3d2dfe90f6c566e
SHA25645a2442186ce9282e9777cc439aabc5d218cf7e4457b7b900ce935c33244a495
SHA5126e2ce8a1244f3586095cffc48c6c5131b7d5c32fdc4b03962ce866349c4c7f6190cdac8f72dba3c6e764e7bb0b8532af67863046b47f7c80f08a1fc7d3d74d8e
-
Filesize
5KB
MD5afc635b38fbdb0b29e6b8efa3b98cdb1
SHA17acd57a9c00ed89d1f4a4e60bc47b652ead6ca39
SHA2568382a0a7622c7c9dade5f14df01afebc6b8036523d25da4fa052cab9bd11a965
SHA512e8a728177ea90dee96b62dcf894c0aaa375477d1643d26cec83f55b78a9529bfae7d08f9597d05742cec4046aab079633a168c6a1216ed70817b3186932a78ee
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
1KB
MD5db6184777f072d8f3d28804aa99da162
SHA1b62f98de6ac12318bb03da9a5329dc7930a474b4
SHA25604d109206044de4c8c52eb3bf17bb335b195f181d7740d18e89b5deb3e0e48cf
SHA512f530c401a202aab567d956a8ea40e76339421408ffbe663672736356e83de4e10992960a644097e4e9f20449be62be9eafa3cde50d6e8c7cd2026c7dde4baec7
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB