Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 03:27
General
-
Target
65461f19bd585fdf72960d178ec8d4ea1583f05257eeb7ab796f5cf97693be70.exe
-
Size
6.9MB
-
MD5
8cfafaa9f17a0cc869e8f0b6a14306e9
-
SHA1
06107e4eba28b0844f1e00cdec1d67bd145b902b
-
SHA256
65461f19bd585fdf72960d178ec8d4ea1583f05257eeb7ab796f5cf97693be70
-
SHA512
6c393b52b8f5aa032a537cb3301581d43d5a3551693036a93d189528c6bd10c26a159561ca1fcbc00f77e970f8700efe058b9e4cabd873d21cdeada9d1c5ce04
-
SSDEEP
196608:8Snj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:8SjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65461f19bd585fdf72960d178ec8d4ea1583f05257eeb7ab796f5cf97693be70.exe"C:\Users\Admin\AppData\Local\Temp\65461f19bd585fdf72960d178ec8d4ea1583f05257eeb7ab796f5cf97693be70.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5SSRS.tmp\65461f19bd585fdf72960d178ec8d4ea1583f05257eeb7ab796f5cf97693be70.tmp"C:\Users\Admin\AppData\Local\Temp\is-5SSRS.tmp\65461f19bd585fdf72960d178ec8d4ea1583f05257eeb7ab796f5cf97693be70.tmp" /SL5="$701EA,6998999,54272,C:\Users\Admin\AppData\Local\Temp\65461f19bd585fdf72960d178ec8d4ea1583f05257eeb7ab796f5cf97693be70.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD59792ea78e414952c124bb97cb9b61dad
SHA1fc9fa226522ae41c222494135ac3b216792369d2
SHA25683bec2178785178b70204035a543c656f430c6a18c301b040a51ec71942dbb9f
SHA5120ccd2f1834d43013aa411e17237a477f16e4e67916b61c5c7f7eed7555d4f7960a2cdb8bb7547da147b040339ee166ebbcc0f90feeb21372a3c8092493417edf
-
Filesize
46KB
MD529e55e121b74985b7ddb223a9ff78fb3
SHA10c672a73a66e24105e6df0e8a48aed5f5b0309c1
SHA256d53a7f7d0a10ce9d59051f2bf08f560c686a9d4f830062329285e41dc613b9a6
SHA512e790db332908ed5017648a94749a16714bce0ef892b88f9e55a4e8c952737d9fb7a2e597a46e5a3f824e2031bbaca23ae4765c5917c7226cddeb517aa8f4d287
-
Filesize
113KB
MD5c2ab3c37d85bb2b6a1f1c7ea7545b2a1
SHA192bd52af7c9dcf0be7758f1972754e1fb19c80bd
SHA256e2219ca41d7170a8f51f9ba7c750da06a98028ffeb27ad13cf71b4f7afd89ebb
SHA5120016b36f59cafdca94cf5715bea9f11a2ab9e0da2f8a59a1d912adac0e52ee287fad6a132092b3f195a20279044c07285192bb46bbe46a2a57c094bab7952be7
-
Filesize
43KB
MD569654b230c33d34edf879bdb372bca58
SHA16f32ca6d16cdecf5f5777ffa049725c49ab481a5
SHA25675956484e8b85185a680a6a887da513fee73a705db4ecc06cd66d4119d4acfdf
SHA5124548f6a6bfbf33f2fe6ea5001821a239f8b7704b910f7ea9a32d39040a6bd044955a7bb61d0cfd2935184a07750caea5bd3160abde40d519e685d991c1eab117
-
Filesize
72KB
MD59554bcf60fa1e38903cc64d2474e1dca
SHA182bbe64059bb5f93d4533301a7d4ff433664b9a8
SHA256e90eace9e7d475c5574e596891a966a557f1d26cafaa6074fa731e4b7304982e
SHA5128311a034fb83e5c5772b7e48a2d11cf6c429dbfd54fdb9ec2fd04ff055509045500ee20763eb4277a9fe0fe438f7f3c84ead8969faab9d80524115ab2aff6102
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB