Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11-12-2023 04:28
General
-
Target
5239a2146ee5764045cf1f79a9a2fba78d44ce561bc2bb6196ace6c7b5c869ef.exe
-
Size
6.9MB
-
MD5
4d34ea17f56df66916874ea4c266dcaa
-
SHA1
96076007a1ce766b95a72ba141477e571cc9f710
-
SHA256
5239a2146ee5764045cf1f79a9a2fba78d44ce561bc2bb6196ace6c7b5c869ef
-
SHA512
35d0da87fddc3697a4ae2b6da9ef9e2410a0f99b2ca34e4607054106fb69c81f260e53f86014a72b13cb973cb214d8141c55cc7214ae39f058d7497d125c8c8e
-
SSDEEP
196608:uA89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:eBmakyVnlUQ7Wz3Tv1jNTh0zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5239a2146ee5764045cf1f79a9a2fba78d44ce561bc2bb6196ace6c7b5c869ef.exe"C:\Users\Admin\AppData\Local\Temp\5239a2146ee5764045cf1f79a9a2fba78d44ce561bc2bb6196ace6c7b5c869ef.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-S31OE.tmp\5239a2146ee5764045cf1f79a9a2fba78d44ce561bc2bb6196ace6c7b5c869ef.tmp"C:\Users\Admin\AppData\Local\Temp\is-S31OE.tmp\5239a2146ee5764045cf1f79a9a2fba78d44ce561bc2bb6196ace6c7b5c869ef.tmp" /SL5="$E0068,6977575,54272,C:\Users\Admin\AppData\Local\Temp\5239a2146ee5764045cf1f79a9a2fba78d44ce561bc2bb6196ace6c7b5c869ef.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
411KB
MD5d52c78f4228b22a21f6e6c3cdeb0bfec
SHA1365ee43d8b700efdbfdf2958bd15dbf78b068bd7
SHA2568cb65b6d1385929b3b57f805cbdba93957fcd22cf98d77536b17d2720b0929fe
SHA5123a1531f13ab830d8b0cca97de7644000e3b351b2ae0b67833c06aab6c3e1ae7d1ce282ab9130eb51dd9e1ca554cc5ae5d3254f6231637a738bad72fdc2dae5f9
-
Filesize
486KB
MD53e0b1df02dc4c7b86851cc491e5defb4
SHA1b7be52fa97496f62f5e73aaec257e8e67cd1e9f9
SHA256e5cbe2fb77464a613e009773ce5a22472286c7ac20ae459a962ae63b1a2a41a1
SHA5122e617935e9cdde0e0adc5598d4cda3bee831fa4d8d2d7a7ab07d547e9c1016a73656dcf0a70d80d6a01109429bf2e11c7ce71edc1cb680dcc3bd86f27bcaa2f6
-
Filesize
29KB
MD5fc7cc7804dd7e61eebdcb7b85c99d530
SHA1093f761f2174b6aaa324029706da5283108c0e54
SHA256e1a4ade420a62a4f67692595ddbd90b7481d360af44eb7e062171c4381781448
SHA512fe32fdbcf87215b68121e838d1b78706ea5f048f62a707af7d7aaed5159373c15fcc6da1dda5c24cba5936bb69057ca9d4f2e380ba6da9712d9f10bcab2e6f5a
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
363KB
MD5c58dc7effbab6624cd97b11da659ede0
SHA1255d0087dc7715df3ad45d8f4d7c9ec53f5c810a
SHA2560d0cd65ff3ee556937627db2ae7e7795fa0b4c9849177d0e83f160832b2bc8b9
SHA51287747b3e33a3018eb5baeca543f6a2b4ff127f9d4a34f9a3133fdb6337baa103cb9b3d9ef78b690f210fbf60778783736c88a0df43a38a9747b7d1f4c9675caf
-
Filesize
209KB
MD5e6a2afb980a666cb97193070db0773fc
SHA150d5c6902b83838ce96c9b3a38713e6098cec518
SHA256afe1899979c1ecec3f9394ced80bbbf080250f4de7e948dca972e6a3fbda3d08
SHA51231eb9f00a07cf3686b51012ee4e08340d4df0ba63b96fd3df2c1b7d21d9ff410e7874a609b6264a961a542cae51d2fa1c724550cc32cda025fc4616024fbf30a
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB