Analysis
-
max time kernel
1s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 03:05
General
-
Target
c7cfed56de662460cd2746fdc67b2dbb2d8606307b90fbb074314eefaf01e57c.exe
-
Size
6.9MB
-
MD5
4be8e48a5b75a393f79714ad65f14c7c
-
SHA1
cf6c33244bf1e5111c17f9f6f499b936f958ca44
-
SHA256
c7cfed56de662460cd2746fdc67b2dbb2d8606307b90fbb074314eefaf01e57c
-
SHA512
893121f12018e6974fd06ff742ad110dc7d659d4cbfe194727a21685cc991baa438f159a6af2f5916b60effa621529bfdea979c2f397d88da6b87434f41702ae
-
SSDEEP
196608:LA89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:vBmakyVnlUQ7Wz3Tv1jNTh0zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7cfed56de662460cd2746fdc67b2dbb2d8606307b90fbb074314eefaf01e57c.exe"C:\Users\Admin\AppData\Local\Temp\c7cfed56de662460cd2746fdc67b2dbb2d8606307b90fbb074314eefaf01e57c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-M5R1R.tmp\c7cfed56de662460cd2746fdc67b2dbb2d8606307b90fbb074314eefaf01e57c.tmp"C:\Users\Admin\AppData\Local\Temp\is-M5R1R.tmp\c7cfed56de662460cd2746fdc67b2dbb2d8606307b90fbb074314eefaf01e57c.tmp" /SL5="$5022A,6977575,54272,C:\Users\Admin\AppData\Local\Temp\c7cfed56de662460cd2746fdc67b2dbb2d8606307b90fbb074314eefaf01e57c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121KB
MD503f7decfc1b52dbfe4ae8a9c95362d60
SHA101041f783633572d8c5e3c475346b0b9657fd49a
SHA256c589d8db8e738312606d96339c55ee31cc9cfd9082309377f308b41cf17361a8
SHA512f4e52ad43c2b9e71b4df1563fa60a28cf57d463a4cfd7b1ea5518f8e6c431c0b750f47d02d73f50bb01b8d4708fc2bab251ad145444753a92e3ade10649abf76
-
Filesize
228KB
MD5774d46d02b4077f2acc716e5033823b8
SHA1547e5fd37b43544b9b4be66a20ef6c81cd469253
SHA25632fb51e0adda0694861ade132c9dea82c383b606d8d51c777b69a2e6eb105334
SHA51217520fc7d8165be21cfdbae0a6e0012cf53f2f42111334f421592eb901b3399600cde562961cbba538f5ca3af656b04bded3bde64ee7b5df45cc2c7954e03987
-
Filesize
270KB
MD5817ebfa0d1627e080a0641b5f651d5aa
SHA1a56d0706ae121b43dc48eeba0f9de2412d438cc1
SHA256723db1cd3692625fb7ded247d2623d7b29b97ef63019b5d2ad6a74e473f03e85
SHA5124e409bf202e77bd01c8a4697cd5ea078900185b77d3cf8c4f4d5803dff1ccf9c5918873a173a4a339cb49db741fac9bf7f8da3a1362691bd6d59e8b91cf0a3a6
-
Filesize
140KB
MD5468e428f5d39d5e230b9b6375fc46d56
SHA1772537f0006dac96378cd2177ce243e0d17df89e
SHA256cbfcde93e8ace2c3254ab8cd7164770d517b4ccde85d898b1093ce9308204497
SHA512f0027cd0587619a77c46da6b1bfa845372f247cb8ba1a205d98ebd05109f519f4354508be024b6a28eb312226bc9c31f58d34b22360d2a506027ce11292bb095
-
Filesize
84KB
MD58d47815bfe6fc8db7d1c265189d2cda3
SHA1dad5f3d405dcfedfd3bb0d9c8b777f75f4fce06c
SHA25650d7f9dd264cde7f449ebff58f0c5f66ab2dce4626c3c6b948e71dd50aa48df6
SHA51219fb864475b534024f1bd792eaff8985d36ba3bf2988a5860d134b37e6ce1ecc1e8ce10c9fb9603b8f8a7dcda7d45f148a27acb4ebe92c6e80f3fa2ff49715a7
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB