Analysis
-
max time kernel
1s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 01:14
General
-
Target
cc3ba42acdecec71f1bada0572fe0add5ccfa01f6aae2c9773f514546eab5f54.exe
-
Size
6.9MB
-
MD5
8eece2fdf3362a92c545f287cd2274d9
-
SHA1
a3a915711509654a52b59d8c1a706c5801491ef3
-
SHA256
cc3ba42acdecec71f1bada0572fe0add5ccfa01f6aae2c9773f514546eab5f54
-
SHA512
99b94bc849a26357c9a87300a1a24ccb7c80f54dd05945c9efff7348f591d3c0946626fab275320561a1ee11df6f99418e06ca9cfb7db02039954760f504abe7
-
SSDEEP
196608:/K2+nNevvWstwr2m5BmycyEbSfasepd5e4x6+AjZ6mjxzj:/DY6tiP3myRfzepXe4ny8gxzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc3ba42acdecec71f1bada0572fe0add5ccfa01f6aae2c9773f514546eab5f54.exe"C:\Users\Admin\AppData\Local\Temp\cc3ba42acdecec71f1bada0572fe0add5ccfa01f6aae2c9773f514546eab5f54.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JFLQG.tmp\cc3ba42acdecec71f1bada0572fe0add5ccfa01f6aae2c9773f514546eab5f54.tmp"C:\Users\Admin\AppData\Local\Temp\is-JFLQG.tmp\cc3ba42acdecec71f1bada0572fe0add5ccfa01f6aae2c9773f514546eab5f54.tmp" /SL5="$9006C,6991381,54272,C:\Users\Admin\AppData\Local\Temp\cc3ba42acdecec71f1bada0572fe0add5ccfa01f6aae2c9773f514546eab5f54.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD5f19ec6af5e531e4f963cb1e6fa4e80ab
SHA192d7a00f04614979b5998fd6406d20285bf28748
SHA256ddaf5e19586c34b4c685374c4287369e0b425949a5de354b24c0b64d4861c5ea
SHA512147b3d94771bbec84e8496e81f9cbfa45444d3be8f6d8d067c272592517a93bfa0dfc6e46792608fe97ab9bcc14067b59a37398acf51e17e007665c46e16969a
-
Filesize
1KB
MD5af52c69ad4da85b1cd6b249f998c0560
SHA1b5805ce878124b7e3c4b84eb864daccc2bb2f5e2
SHA2567c25b267ec34c4bf0cecb08dd9f06e4674d8f54c95eaa4edabc511b071a86b09
SHA5120c0d757e0e07077cdcfc629e9070c72fd60d5c73f642290afa067e662938262ae2acc13a1d0222dc52d677ecd332f96389d4b28334c5a8b0795dd1d2e6a93aa7
-
Filesize
98KB
MD5c68fc7142703372ba4b981cc97d0faf1
SHA19c384fa178ec5f61805190c0b7f60dfe3f7272a0
SHA25634313d73e352f3e450b53e37474eeba6addc362e24712d27b53e7902fe4ed7de
SHA512b15f9dbfdf351f39c8143716715b4b221d0f3ffea81fee1017b50bc6b34faa3786182aec26aa9281e4784c8bd1be7e0228c3e35296489b211473e428f18834f5
-
Filesize
1KB
MD530f56d3dcdbb4cee25cac7637364c580
SHA199fb8bc836254b3d273fde24225fdecbfbf58253
SHA25624925300046609e14788b5a383ecbf2b11eeb555bc8b2f99ed0729cf904e0128
SHA512183246d537305beb844dc9e9b62f400f7a565b38f014cf31962c373be5fff892b48dfeb59a552a15b94dee7d687c2bedcc3e283194a9e4244183e7bca1a1f121
-
Filesize
1KB
MD5db6184777f072d8f3d28804aa99da162
SHA1b62f98de6ac12318bb03da9a5329dc7930a474b4
SHA25604d109206044de4c8c52eb3bf17bb335b195f181d7740d18e89b5deb3e0e48cf
SHA512f530c401a202aab567d956a8ea40e76339421408ffbe663672736356e83de4e10992960a644097e4e9f20449be62be9eafa3cde50d6e8c7cd2026c7dde4baec7
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
7KB
MD53e40cdb76e5fea3d235b7bf0d5424797
SHA1dff1d3eda52bc62827e99638bd618c3e2272fc87
SHA256d7394d3bc3d097b510859f97b831c556cc847e6049ce11994c22ccc416af07f5
SHA512e6225f9bcd5ca4a2d8a06549c4b102f79648518ab33b605886d36f0fc86c5d1c4c0df36da211fc84ba31f00342c5f73c63f9e50eb14901443b4ba5ef0023c771
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB