Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 03:44
General
-
Target
374d444c42ad5fece5c51efd4a760160cbf40caaa19201e56c91926ab03f205e.exe
-
Size
6.9MB
-
MD5
3b17fa61d1cc51753802e43d935a4636
-
SHA1
1ade8b682ddbf1a56c5a38602db5db32d95c28b1
-
SHA256
374d444c42ad5fece5c51efd4a760160cbf40caaa19201e56c91926ab03f205e
-
SHA512
1dfd1f64a57fb48d20df86d4da62196cfd81617511ef6317d788f125434b546607b55ecf24ca7413a556939019782f4a1f32e31d8253e67eba863bb34d8c247d
-
SSDEEP
196608:zSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:zSjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\374d444c42ad5fece5c51efd4a760160cbf40caaa19201e56c91926ab03f205e.exe"C:\Users\Admin\AppData\Local\Temp\374d444c42ad5fece5c51efd4a760160cbf40caaa19201e56c91926ab03f205e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CGHPS.tmp\374d444c42ad5fece5c51efd4a760160cbf40caaa19201e56c91926ab03f205e.tmp"C:\Users\Admin\AppData\Local\Temp\is-CGHPS.tmp\374d444c42ad5fece5c51efd4a760160cbf40caaa19201e56c91926ab03f205e.tmp" /SL5="$5006C,6998999,54272,C:\Users\Admin\AppData\Local\Temp\374d444c42ad5fece5c51efd4a760160cbf40caaa19201e56c91926ab03f205e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5b6b20a6dbf0e1a97b60ee5ac2b9fb0d8
SHA1b6aa4a651797a2c4ccf905869c2e556e12cb58b6
SHA2564fafa5876d09ce0994b61a32841452a610fc86fb9c9e8c08f9d037695b73d78e
SHA512ab043ed4927107e882bc10e61ec6f478fed08ee6e1e160d3ac7fab91351a02ea65ba58e6ca7b6e5942b680c76daa1e6e372972c1a59bd8189d3199d6db2592f8
-
Filesize
124KB
MD59e0c3fab2b45f6d66542cd4d56d17b2e
SHA192690f5db96a74ac32801106e0fc70346952dff3
SHA25671c5a2d274cdaeaf41571e683ff135d8cc936887e208ad22b8548efeeceaae8d
SHA512256e23d8e250f2d3e3cc3629201f65f4362e982ec282043126e06a46e8cd9fc7458259f02397ed6a46811b1154c607c1e3ddb5ad5a6f75cc657fad167f7fc818
-
Filesize
92KB
MD5a2dd92c0f8333ef036537291328bb275
SHA1edcd83874306f3dc76e6eabe1993f7f0f10c1a5b
SHA256f74f0969997697ef16ebd059150c57a1a77732f2b5b1ee7e4201330f920cffcb
SHA512c4b50f86867e25faa3fc54d420d261ab7442ef57ca1b7036c6eeb8916c2079a1c072f44f85e2618dfec512c89da2c270be576d034f9617150ab45a1c5f155f7b
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
106KB
MD5f80c4c527ad746defd220a3668b5ceb4
SHA1130052d7ed5142d729c622ef8cee26cdbbb090da
SHA25672da4512472998fe6029809d77ac807eb2ff9f3dbbda13cdf25cec376e599f94
SHA51261df01067dd7ef350d9eb5b7afbbfa6f1581b542aa39fd97524cb49643d76624b968925aff25185e3a68e432291fd75289e97e98df029f345db2cba04feb831c
-
Filesize
129KB
MD5cbc44cccc6b34fb6ca93d93263f58dd8
SHA13038178eb8ae6afeb4c84199576b8a7d69ea9dab
SHA256233aaa7158b7850fb72646178af35560f525aeb037cb02db7ce2d00a4da412d6
SHA512ea75fa11d01d8838a96b41f1b0eb3f343e040e219d22fc5e4f5c129e6082120e53055d651897e019ed4beb44fa3aed2387daa57ac72af6c6f42970d6fbed92d1
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB