Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11-12-2023 01:20
General
-
Target
a063db246b7b40d51db35c60d2fb7591468086b4a0b7c2ceac4599ceaafa71c5.exe
-
Size
6.9MB
-
MD5
363038fbc2f7c44140d1a8c1cccd2574
-
SHA1
743a11dd932e535f5d59fa78276ef3ab86b08b30
-
SHA256
a063db246b7b40d51db35c60d2fb7591468086b4a0b7c2ceac4599ceaafa71c5
-
SHA512
302153802302b0c7ca8c3371591f0a3886b67d1cbe835f55bd3436f99609d27f7f196d08933d40a028b4eda877120fa4aba18c26739db60c93f2929e5c662da4
-
SSDEEP
196608:cA89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:ABmakyVnlUQ7Wz3Tv1jNTh0zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a063db246b7b40d51db35c60d2fb7591468086b4a0b7c2ceac4599ceaafa71c5.exe"C:\Users\Admin\AppData\Local\Temp\a063db246b7b40d51db35c60d2fb7591468086b4a0b7c2ceac4599ceaafa71c5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-99L44.tmp\a063db246b7b40d51db35c60d2fb7591468086b4a0b7c2ceac4599ceaafa71c5.tmp"C:\Users\Admin\AppData\Local\Temp\is-99L44.tmp\a063db246b7b40d51db35c60d2fb7591468086b4a0b7c2ceac4599ceaafa71c5.tmp" /SL5="$B0092,6977575,54272,C:\Users\Admin\AppData\Local\Temp\a063db246b7b40d51db35c60d2fb7591468086b4a0b7c2ceac4599ceaafa71c5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157KB
MD5957a0291a4a574219d7b98a8a35c657b
SHA1d1da8493d302eb04dfcee03da0eaeb81d78bf29b
SHA2560f5feb5f039808a8fcbf3d9e46640edbac4aee345952ace866f73a7cb36abd47
SHA512ff08e43fff44de57ffc9e2cddfe0b0e61ebbbc574baef35bb67138fb5ca9d023371bb9ce3970e4c549933de46a7d90282f879f961e126de8e25e72bd8cc5f576
-
Filesize
116KB
MD52aef706c9326e5cad490b2ea58f8e5c1
SHA1eb241faa5363b0aa7db7bd2432bdcf69c6e6ec4f
SHA256fd9767ee57c310e86032f4a67ed0cc459f330bd97ec0b820b172a176428edf3f
SHA5122a1e4f5ca61386478fa89ac1d3335e362811235de2d5160406d158c61492e549b082b7852538891bb8d3762ed52a7da552c931e621010c4f99261d8bdcc3c61d
-
Filesize
168KB
MD5dd6fabaa8f05b5edca83c854f7b1dfb8
SHA1765deccdd0180b5d2baffb9f35413e97be010da2
SHA2568f954a98c447dea7e09d0bc34ca2d8bc0f64d96b9a37b07eca7504f20e251dfa
SHA512535dc0da8d230e52ecb7be9f64ab6c68c205b4827bda5004c815ce2de958fa15bc761803ab260235e90570c5fbd84e384368efe82e1c0a08747a43506c0dfae3
-
Filesize
262KB
MD57345e9015576139942ddc03a8f5f88a0
SHA14e59f07e00cb1e40621a43f21b8f365218668ca0
SHA25680aa9034220ca71db065006c12ddf5dce24e4c25950002be7b4e360042c78392
SHA512c80983d4ee259e58a66613d5381a9804a323b274641668e685eb4eae1a16d333dd78ab86881addd0771f914f776232ecb5f00706087c0ea453db7ada0161dbb3
-
Filesize
331KB
MD5e35429a1811de281dbb77e4568a4c3f8
SHA16f460d6c9336d905d87001096af8b0e4f9626873
SHA256d74172f88478084cd27e5679d8a6dde739b575cbaf2749a43fc0dae2ec88d795
SHA5120cc26e7c2118bb4bb6a84e6f29697d7b28540510ad18427b971b89e3906984ebfc2f0fb735e34140b9401b244bdbeb668c35e8725a8f52bc753af52444813af2
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB