Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 04:24
General
-
Target
2d86ffec57a165a8fb4734a16563ceedee3c27ccffbb7f67db350bad5625d58e.exe
-
Size
6.9MB
-
MD5
71bbf421e85dc8e74a54777d30b6dbe2
-
SHA1
5cd3e0f1b7e0f20a1b01a3779937bb4ce2e579ca
-
SHA256
2d86ffec57a165a8fb4734a16563ceedee3c27ccffbb7f67db350bad5625d58e
-
SHA512
6f0f0c1d32362c2e4601369f2133aa65d35db70f8d07e6b776c1269be007679eabcf5d0ff3b9b9592a547bfda4ecff06aad5ab21ca2c06aca307da429d10e819
-
SSDEEP
196608:KK2+nNevvWstwr2m5BmycyEbSfasepd5e4x6+AjZ6mjxzj:KDY6tiP3myRfzepXe4ny8gxzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d86ffec57a165a8fb4734a16563ceedee3c27ccffbb7f67db350bad5625d58e.exe"C:\Users\Admin\AppData\Local\Temp\2d86ffec57a165a8fb4734a16563ceedee3c27ccffbb7f67db350bad5625d58e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8N32P.tmp\2d86ffec57a165a8fb4734a16563ceedee3c27ccffbb7f67db350bad5625d58e.tmp"C:\Users\Admin\AppData\Local\Temp\is-8N32P.tmp\2d86ffec57a165a8fb4734a16563ceedee3c27ccffbb7f67db350bad5625d58e.tmp" /SL5="$70202,6991381,54272,C:\Users\Admin\AppData\Local\Temp\2d86ffec57a165a8fb4734a16563ceedee3c27ccffbb7f67db350bad5625d58e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD527148ef819afb93ae1c0a41057e606e6
SHA1929b0e15ca49e8d78e1b9a6477aabce470b63d1b
SHA256706eb39436b85573325b4b57966afc358b7ab4bde82399af935c603df161ee7c
SHA512722b4422b03f50b4dc2490d5f4c1db68256081d73bcd93d6f5a3e65ce20d59571010a3d5099aba6a67598b03a986adb200d84dd329cad1aba2536cc0bd0cac00
-
Filesize
120KB
MD5a49cb54b44052875e992fd1a90755c0c
SHA14353e1d8e0c571b520e206982805b6ce1bbb7efb
SHA256d19f96a97284d6fbae483bcf07aa60dffdd5b727549d2208b9fe251c454a277e
SHA51210bdca159185261464c664bbe8a84351371c8a9e346a5d57b14ae627973c74af48e3d3b3091d5fbded96795f46f77a4c3c46f60733cb62ef07b53d8d85336e6c
-
Filesize
242KB
MD57953ad5e4a5144c7954d4b6ae491dd45
SHA1db2813f8ce902e6f98e7a9179b796101d3786dd2
SHA25633eb1e0d2dc3f69341e02d3504c8336a6e757f85d0e159a646eae7306fda3b7d
SHA512b3f7bd7f0cf10d531767fbec6935ca888610bae74419d2093942bc0893ae282adacf04ca72b2462f47544b32a7436ce4abce42487a060b65b3cb7c50f576744b
-
Filesize
44KB
MD5c9c4bcff311fd543000c6d5b926b8e4d
SHA13afef59caa80337f6c463811948786ed53393754
SHA25624143515df7687fe03caf95e3d2bd87905fcd6bbc7ffa52cf8775a6b53a09eae
SHA5123f5efba80c18483d05f9fe3043e302dc974bf1e3dcf1f35fed2ce24ca8d38672f78a32bc7941663daec6e1810ded5f1da26ecf0f02dd13405876f65da83e34c6
-
Filesize
5KB
MD5f08aff91a13091a6a32547a31d3ba1ac
SHA188513644835e2a1932d2e6ffc3584b81126bdecc
SHA256be318b522f639a92fa1622800732094a2038b614b61af2ef0ede93d451d6759d
SHA5124365b60e3afbe6bb6ca0f63b8230ced7485a56d46a4eb9ccda8c152943bd7bf49da4e438fa21bac69a27f716b30f247dabdb76ca3c5b7286e61b678d3889e287
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB