Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 03:32
General
-
Target
e613b4b330c9c4cd136086c8876d1347c7b4f9a18a7fca7626fdd0cafb488648.exe
-
Size
6.9MB
-
MD5
a44d06087ca32a2424a13da9d6bb1f28
-
SHA1
b16884ddf1c5a85ee6dad67186d5f04450d47c0b
-
SHA256
e613b4b330c9c4cd136086c8876d1347c7b4f9a18a7fca7626fdd0cafb488648
-
SHA512
66fa917ce420df13b817fd13b906fc17aedabdf1db9723f8b7610e6f7520e7043738cdeb62fb3b265eadcec2a0fe5785b1b4252dc2ff80e1f0624c76adbbddb2
-
SSDEEP
196608:eSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:eSjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e613b4b330c9c4cd136086c8876d1347c7b4f9a18a7fca7626fdd0cafb488648.exe"C:\Users\Admin\AppData\Local\Temp\e613b4b330c9c4cd136086c8876d1347c7b4f9a18a7fca7626fdd0cafb488648.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ABMR5.tmp\e613b4b330c9c4cd136086c8876d1347c7b4f9a18a7fca7626fdd0cafb488648.tmp"C:\Users\Admin\AppData\Local\Temp\is-ABMR5.tmp\e613b4b330c9c4cd136086c8876d1347c7b4f9a18a7fca7626fdd0cafb488648.tmp" /SL5="$70204,6998999,54272,C:\Users\Admin\AppData\Local\Temp\e613b4b330c9c4cd136086c8876d1347c7b4f9a18a7fca7626fdd0cafb488648.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640KB
MD5573e808b97da96b8041815558a6eda91
SHA169b6950f751d1e290e314c7cfcc330e649930f40
SHA25607c2b178a97b7127594c6c38d8f07e0443a9f713a1f4d976f4746052dda1a0c8
SHA512d49cd991046cf542b8f1ac6bc72df185cfd9141b58c19ce386e01d05ee50935dd4d109d23b09fe317c1710564cc37a71c9e2aff711e4731cbcc6334857cc95c4
-
Filesize
638KB
MD50e50fc1092837a69b52c210a2ab2b7a0
SHA1694d03b6c6ab24f04cab781118e6b8c24e1cd895
SHA25603cc940a4eba7c0e3c18064ba411753a2ff39f30c8825401d22c5ed688e82a64
SHA51298003a87f30a5ed8ffd46351593106359e7ddd315a1a5a59fc6a9be358cf90f079053981f9120d203d1121a66384352865617b713ee5e41a53056730acbae200
-
Filesize
568KB
MD521118431c0a95204cb3772887f9b0719
SHA1c5493b67273af1dfec23e3a062e9a316b967be10
SHA2560d3379a6a296666555f485d2e51bcacabedcaf94cabac9fcd8fc5d50cfd28725
SHA5123bd1251be3fa4b679c1c161de1f967fa8a28d822960f0930507b111e94627b5ef95d130db089fd1dea5b8a3ac92887b0dd5c0fa16593090f38a207b7f74d5925
-
Filesize
338KB
MD5282469296e7b234105a0d4f5a9b1bf9f
SHA19cabf63fd41c728f73e75a63cc0497118e982d58
SHA25677b0c9318b0f984ecc0999471b104fbc7a17fe106539df32785a0f5a6a48004f
SHA512cd2ce2e433ae6d4ae2924246bf5c46e6771b05b4f083eba8f5bc769bb5f1f825d66c51f12a65ab7221e34c4a498075decc99da604f214916b623af3bc8687638
-
Filesize
254KB
MD50b59f7da1353abfc902ccc743387ecaf
SHA1e6a2d50e08139ef95aeeafdbddf3d4ba2f142ac9
SHA2564b49c588d992b02c3c7d271680da77e4c91c5938a509b4709977faf7a400356b
SHA51258e2daaf176420560eee40efb99fd63a2ecac5927e942c0bae4d58663b23f018cfba4827e170d1e8d7b17ebaa70fe658ee8f3448fcd94dbc0232f1139bc641b5
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB