Analysis
-
max time kernel
143s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
11/12/2023, 01:08
General
-
Target
09c15983390b8020691696404446adb5fe94be025d1672f7d0428e283cc80056.exe
-
Size
6.9MB
-
MD5
c1223112bc5af6579cfac03e8a6d9486
-
SHA1
ef5b4e05e4a182718217c9b2133fda476fea6ccf
-
SHA256
09c15983390b8020691696404446adb5fe94be025d1672f7d0428e283cc80056
-
SHA512
2a77fdf4328815a3888fa1747fd03f704e08ecaf8901117360420edaf79939e1dc1fabb621cb16afc2f81463669fee81e780f57c8d3c2bfcc8fa56feb439eb5c
-
SSDEEP
196608:SK2+nNevvWstwr2m5BmycyEbSfasepd5e4x6+AjZ6mjxzj:SDY6tiP3myRfzepXe4ny8gxzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09c15983390b8020691696404446adb5fe94be025d1672f7d0428e283cc80056.exe"C:\Users\Admin\AppData\Local\Temp\09c15983390b8020691696404446adb5fe94be025d1672f7d0428e283cc80056.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PM2DT.tmp\09c15983390b8020691696404446adb5fe94be025d1672f7d0428e283cc80056.tmp"C:\Users\Admin\AppData\Local\Temp\is-PM2DT.tmp\09c15983390b8020691696404446adb5fe94be025d1672f7d0428e283cc80056.tmp" /SL5="$901E2,6991381,54272,C:\Users\Admin\AppData\Local\Temp\09c15983390b8020691696404446adb5fe94be025d1672f7d0428e283cc80056.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5c0c5e7eef8db4db126d0e7d726e99200
SHA119a51a2e68ba4918494145ce3106f6c9f52beae0
SHA256d49dbf622379a65c2e5d18eed857c7b4d5e38ef3d16ad8ec259f151a822dfd44
SHA5122c91844e015b18098f100e5d629750727a00ac7526a42049513f3dc8c2447835951e510c5acaf4a28764e409d9ee7325760f75ce3da2ce710a419b0997a34c06
-
Filesize
127KB
MD5bb1ff781a73f8e2e10e103bc595b5241
SHA1d2f09de6365d25f0022193f73f85ee459c3aa328
SHA256f44a3e638bc777ef6863d08af27c0b8b43f0ae48cf1323f1cac808440a93d733
SHA512ffb75dc99fa3a84bba13977197624d7d77ab3f1994ad61e1ace6fd3dd61137b16c73acd7d3f1509889ce6fb09046d32b8217aae194362f2032d54b6588a90e0c
-
Filesize
14KB
MD54ebe37aeb8990bf3768e0b23027b2883
SHA11e103fdce4af439d55efb32eca2cea10963fcd10
SHA256798a6f0bef6ec94802b9f6e7dc5e6c7f4b4e95634390850a6a22586c18c844b3
SHA512f7b517842ae30a6ab43f4330e338e44161e00220db1d12154c38562d7a15c8c836622910bb231f825ba738bdd7714973ee36d51103f2aa11642092884ae3cc4e
-
Filesize
20KB
MD5b987d256321f223d22491f7d30e901f4
SHA1e39341da03254649dc62f244bdeb62f9b085ff55
SHA2564d97db37854d8c643c83943401214e9f7731760a4a90a7ca2ae05959df1cfb54
SHA5124c17811e8de14e24839f17596b14af1ce6ecb223baa842e216bf3a29624b032abe96f1bd9a5cf1ad009c2ab26b7b5757ae668716292be4aba084d0496c5334df
-
Filesize
1KB
MD514d083317674748d4cb8e3384484c890
SHA16b8c9037700f569ae228d1c8998b1d9faea21a48
SHA256199e49960b2cc64da68cc9822271d7a667112c42703f976d38258f8c83a78a67
SHA512f3d093902aa2d158e726ac6dfd689036352fdef5c6345941cc747fc175701ccc4e0215567e9620abfd17fa3f84cab07e1654957ce56c2fce4a6b898faf253de2
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB