Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 00:24
General
-
Target
eda566ec007f253857b4626219042328e21373a835254be942b77a5f47015d4c.exe
-
Size
6.9MB
-
MD5
c915f8f9a2a77bc5fabb4edd856c5364
-
SHA1
44fb452f3059a31a607cbd24f42bacea2664f7ef
-
SHA256
eda566ec007f253857b4626219042328e21373a835254be942b77a5f47015d4c
-
SHA512
ad15c7e57bb41f4ab1137fd1786060116c2fb9834b96267c9fb587e2de2e945a2908dbf5e9a56828f6424966f6755de32b42de76b66910ac513485180d79489c
-
SSDEEP
196608:GK2+nNevvWstwr2m5BmycyEbSfasepd5e4x6+AjZ6mjxzj:GDY6tiP3myRfzepXe4ny8gxzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eda566ec007f253857b4626219042328e21373a835254be942b77a5f47015d4c.exe"C:\Users\Admin\AppData\Local\Temp\eda566ec007f253857b4626219042328e21373a835254be942b77a5f47015d4c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JV74R.tmp\eda566ec007f253857b4626219042328e21373a835254be942b77a5f47015d4c.tmp"C:\Users\Admin\AppData\Local\Temp\is-JV74R.tmp\eda566ec007f253857b4626219042328e21373a835254be942b77a5f47015d4c.tmp" /SL5="$B006A,6991381,54272,C:\Users\Admin\AppData\Local\Temp\eda566ec007f253857b4626219042328e21373a835254be942b77a5f47015d4c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155KB
MD5be641fbd4bb3d745c60a0e1fd7d1ca9a
SHA144715dd0441ebbd9f2cbda8b9e63794e706ba1de
SHA256f3ef9bf05b20882afa098d1316d74d935e5d0c88181ba8bee36cba8195dafdd0
SHA5124050e1251298ece956525b6314ef1e9b0a4bfc5db9d94e533a0e3a5e91ff709926b9e71e1cfdcdc318a4a1f1957e2c65ddab8b66e4c08769da700de2862893a8
-
Filesize
100KB
MD5fadc064ba9d0e62bfb897282a99bf8da
SHA13bb397c6a2702554908048be053312f3db3ca578
SHA256d2207a05a0a94856e4d562931739cf4139a592bc45a81182a62450da2580d8b9
SHA512ade56a33a79bb769785ed43627f8b2c7cbdca0c88a405aed5b98e5f0028c477eaa1eb96302d98d6016ba4c8123dd1498b348246548710fb6b62c9149308a7d05
-
Filesize
120KB
MD5278848a6a8bc16a967ad95ffe955f863
SHA1ba1a6b777ab14a63c7af4bf8639f02f4dca10c54
SHA25632d3642e163a7d832ad0f4f95a0eacb81d47d1d06bce32e6bd65b49c2b4ede39
SHA5127e559b7a218080365d9cf3fe6c15495e22868eec40b413da7a6c5e7c66aa82b312b5980fdbb6f412ec7f5c738d3c1d7c186ff6ff787f1ce1b29d82cacfd61dfa
-
Filesize
67KB
MD575efbfa0fa7da1102d4761f9444117aa
SHA15d5b0f0078b4815b5f468b2e84598d6836223956
SHA256b0d4c05624a2a477eb1dc174baf9e23123c811c7bec8ccd9b2515c3f2414a2d5
SHA512a5ee65b28c7a8fcd49a34cd5c484065cbfe7ebc1a0878cc30e2078cf396a5ce38fe3235c64844915c1e6b7c159f2cd6a0a702ad448d0d9fdb294125ee66d2079
-
Filesize
83KB
MD5c713aa790acfa011cdccde0911fe98a6
SHA11185a1854726a164d03ba23bc9b40d71f27c9bcf
SHA256f110662a8703e43f9a4a97c68b553b4997fd646e70a7d7afac2b5c1288a8e1b9
SHA5128e991e2df86a132e2b57be40d6d0379bcd612b2df971e309e72f5f3b0125fd6966f3fb7bb110ffd5148a84a77548d43781b174e2019add13a4061b69d15cb6c2
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB