Analysis
-
max time kernel
133s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 01:10
General
-
Target
0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe
-
Size
6.9MB
-
MD5
9c61d38fd9c85bb00d18bfe03bb7d437
-
SHA1
70520013c0d5dfaeb0c695c0b38e04a12843078b
-
SHA256
0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f
-
SHA512
0d05b6e935d34c8408144fc7fd465e34ab3ba8b425d937e074af6ba70050c034b7f6373238cf4b1464678e5ec5e3cd0921ee7bab26c6c1d203b546ed65beaebb
-
SSDEEP
196608:uK2+nNevvWstwr2m5BmycyEbSfasepd5e4x6+AjZ6mjxzj:uDY6tiP3myRfzepXe4ny8gxzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe"C:\Users\Admin\AppData\Local\Temp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HK2PV.tmp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp"C:\Users\Admin\AppData\Local\Temp\is-HK2PV.tmp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp" /SL5="$70204,6991381,54272,C:\Users\Admin\AppData\Local\Temp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230KB
MD5e07e9360df78867c5ac2184d0a8df39d
SHA1a27657bbe2e772d55f065e995d9c898030410bd1
SHA2564a97066a135f1104aa29d27aea47df29c84fb35660de7fdeeaafead6fc01516a
SHA51292cb713798f39ad82678358b9be0e6339665410b1fd3cce36ef50d843030ba0093b1f402c27c4b04430d0a71ebd245df7528d9729e0dd654b1a179edd731e41a
-
Filesize
182KB
MD5470dad8fa97025e690c2e3b1eab204c3
SHA1ff5156ff9c3937566e06b94a8a8a4f950de99617
SHA256df610dcc49fffcea7c0beef6e6579ecd0a026bf2c8eb0b6b4cd469fa3855f689
SHA5125fd9927864eedfd42576c55bf1b846e50bbb55eb21d1bdcb08fa5b1226816204c76064e2bfd044587c545ff2a9e6f23c3348d7f289abe750583e186a5096b284
-
Filesize
111KB
MD56f141b3c8b6dc4b6047ba7ab98426b10
SHA1cd7121338a4e13649774c15151f385d9ff33e87f
SHA256320912b59d8d0b0e0a69e76c0c880606effb4acaba0cd038156999e7e955597b
SHA51267bd18256fb7b71e419f7ff02185f8db7340ed5472992849be314d46ba17ed3291d9b96b73cc555b18dcf56746d62ce1f47f6beecf6742f7f47b92022d42c154
-
Filesize
136KB
MD5293be1ef7fb17890318a2174bf404291
SHA1ec15f6fcd17e30e4bacc341cbb99b1db99f69c0e
SHA256d928e63187e789feb3fc4d3520d7f45751c7581e31d8b5424e9383ae794f7bb1
SHA512f1e6928f924d799e43e870cab29188b35c0094da9fa312458dbbefbf4973d8630fde4e81105d3245552754cd8e66af2f8b498628dd938a562f888c39f14b84b4
-
Filesize
144KB
MD574be442719edefa207cfd65685b096b0
SHA185035e2cbf106e5edd57ef75b8b5fcb904a00f4a
SHA256f0ac718fb0bceb7ab81c6adb637fe831ac1e00290db2f8549dce6fef24758187
SHA51271203df7a304694e9ad4fe87e0301bdea1f695323c7bbe3426f6b4d6295e14340194091381ed49757439068c66dde030e45b35f073689c420a2eee95d7807a5d
-
Filesize
1KB
MD530f56d3dcdbb4cee25cac7637364c580
SHA199fb8bc836254b3d273fde24225fdecbfbf58253
SHA25624925300046609e14788b5a383ecbf2b11eeb555bc8b2f99ed0729cf904e0128
SHA512183246d537305beb844dc9e9b62f400f7a565b38f014cf31962c373be5fff892b48dfeb59a552a15b94dee7d687c2bedcc3e283194a9e4244183e7bca1a1f121
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB