Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 01:27
General
-
Target
4cbc7541e3794f19f8fb04f543339e3f8fd4b24d80f2a11d37f8904cda0e61a1.exe
-
Size
6.9MB
-
MD5
179b5042502efa00148570c7c13d65f6
-
SHA1
b9f9529591b512a8424b4e18a5ca0346df21d5f4
-
SHA256
4cbc7541e3794f19f8fb04f543339e3f8fd4b24d80f2a11d37f8904cda0e61a1
-
SHA512
b0bb5ec8ce392ae79caaff6a3cab0c8453256710e6aa3192eb08294e5de64c08a42ffad42b79b07cf42b77610f765ba6bd2987734341c4400cec2c93ab096b4b
-
SSDEEP
98304:X+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:Oz25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cbc7541e3794f19f8fb04f543339e3f8fd4b24d80f2a11d37f8904cda0e61a1.exe"C:\Users\Admin\AppData\Local\Temp\4cbc7541e3794f19f8fb04f543339e3f8fd4b24d80f2a11d37f8904cda0e61a1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0NQOK.tmp\4cbc7541e3794f19f8fb04f543339e3f8fd4b24d80f2a11d37f8904cda0e61a1.tmp"C:\Users\Admin\AppData\Local\Temp\is-0NQOK.tmp\4cbc7541e3794f19f8fb04f543339e3f8fd4b24d80f2a11d37f8904cda0e61a1.tmp" /SL5="$50066,6985375,54272,C:\Users\Admin\AppData\Local\Temp\4cbc7541e3794f19f8fb04f543339e3f8fd4b24d80f2a11d37f8904cda0e61a1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD5816898b9fa9e6ae4f0709abd91a96bdc
SHA126e675f8fd6bc01d639741aa16a5fd02c2b11146
SHA256f22a02b1094a47048affaeb4c3c095d338169940429b05c0d129c41063d9d6f5
SHA512b52a13c63e145261af6a5b76b0c5f63a314e4b2d1921432f87e35a8b34b2fc20b34c10dc48c2009032185dca39e309223532be3afcd32ca99392bb1d14bb929e
-
Filesize
249KB
MD59f4d716bb9e83d22e274733f9089b52f
SHA199c93adc369b3c9bd2366c97b93bc2686854c76d
SHA2560dfa512a864b99df037ab699591da73412e84e423f1d1b23d1ef7a1474238b36
SHA51268f9d35c889e3a86edd064b10c0244fc9d0fe750a8294af34551350f845d791e126329f466d4e43b4d58662ce9e6d7c4379e96e001cadae8fc2818833576c13b
-
Filesize
326KB
MD59b4b24cfebe465f304123f69c204aede
SHA18b16326157221a7779dd02752bd6290de191e4e5
SHA256199bff84806ab36cd539d310904a08f212e2b8fe979f2e1e80e67f3e60527f59
SHA512e97b6c48fcd7b3a0d009b63a59ce6e9628f049d419497658836802e573653ac73f9ae38e8415bc19c4833ab9d4c66d8eccc2a78cd08604a91813cae7b36855a9
-
Filesize
447KB
MD582eae2b5b24c3fa4f3f8e4a70364f62c
SHA1af212b19b4442ef578b5403c68bc4c3ca2c70375
SHA2560762b10afe797e3a790611e8a90d9ac11f20582cf89be09c055425c086867805
SHA51296a53e5182cb83ef7165cb6ca9fc4725c05d852ce664ae5faca58d68a0eb16d6dce2b2f081a47edecbedc7d7106d0b4cf43bf17b526feb84798692547e8491a5
-
Filesize
437KB
MD5206f2e217b5c542276708a24cc5d0530
SHA1d8d6050fa4d6157482d3e1949a16a91dafc9f260
SHA25688e0711ab0f8a8c0114576bb0cd2b794215bb33d232ad200edba11b5090fed58
SHA51227ee424e084a72d154fbed28ff524c55ccae7e857bd25fd00124e47b6ee6b5a3344e45e5f39f4abbd257df169e7f68ac4c8d81e9c4015650c727bcc463ee5364
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
4KB