Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 03:57
General
-
Target
7dcb9e9718c8a7461a5b4608b2e03cdec3debb28b4c0f4ce30aaa5fea909adc5.exe
-
Size
6.9MB
-
MD5
aec7b50220c9db58bad9e0e285c73538
-
SHA1
297b5024c460b3fd0c773d63c96d7a59a8462c91
-
SHA256
7dcb9e9718c8a7461a5b4608b2e03cdec3debb28b4c0f4ce30aaa5fea909adc5
-
SHA512
1beb063da7411efd72e52e49c25422a1ada09c714c16d943f95641367499cc6c61f85b81e8252c771d53c176b07a934f02d94b618b86c673bdcce9d9d426f1d3
-
SSDEEP
196608:oxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:ANztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dcb9e9718c8a7461a5b4608b2e03cdec3debb28b4c0f4ce30aaa5fea909adc5.exe"C:\Users\Admin\AppData\Local\Temp\7dcb9e9718c8a7461a5b4608b2e03cdec3debb28b4c0f4ce30aaa5fea909adc5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VBVN4.tmp\7dcb9e9718c8a7461a5b4608b2e03cdec3debb28b4c0f4ce30aaa5fea909adc5.tmp"C:\Users\Admin\AppData\Local\Temp\is-VBVN4.tmp\7dcb9e9718c8a7461a5b4608b2e03cdec3debb28b4c0f4ce30aaa5fea909adc5.tmp" /SL5="$80202,7025884,54272,C:\Users\Admin\AppData\Local\Temp\7dcb9e9718c8a7461a5b4608b2e03cdec3debb28b4c0f4ce30aaa5fea909adc5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD563253fb2364b3df1cbf4cedce2b817d8
SHA1cc933fc07ea8bd7378893676ccf9ec6efe6963ec
SHA2567580b17effed63817f72eddd0bd29e546e8a7a51759f527ecc86f5e4df757d77
SHA512bd62901d0349c21fda35be8159f9631a41012437e5c4b412fa6fcc071568135534dd161c05ca4149cfca28c0e0ceaba01e0600571f62c629a72b52957700ea64
-
Filesize
42KB
MD5e6f0a8b4f7f604f3c5bb9d3d460771ab
SHA15d64a7ef5e13764ad82bf4ac8a21e8f4a54e8f9d
SHA256d5f1ebe62f6946dfbd55a4fbeaa997797a1079134f359272e6f76f69d486f757
SHA5122d41f2f34c5e2082ae06a6eabb23b7f21ecb76b4756f15da5f2e45a6cbf03dd8897c948e89586c2d09cf2be37b935de52a0a835363229ef34e5ebe63c9109019
-
Filesize
47KB
MD537f588b6ca38647196fb52a600385796
SHA1c7b94b4068c9e1d2f2cb7996d50a71ce80367dc2
SHA25691ced9c94cebb98e1f71b0e15ef1efa963298eb0c97f24543d38e259482b328b
SHA5127b3fa90e529be8c5971e74bddc2ec2795f0c543f7da2a087d5a0b271baaeaa45615e7248f5abe0e916432b3e275ca660134e12a3c526882c5d0292abc44d2fd7
-
Filesize
371KB
MD5e34425aea2298a71bbb5b8cee5cc66ef
SHA1e90135ce3300134cec72d32763135d67ca679625
SHA256e8bb987ce1eba6340e6ea217aa9df91b654bcee3b190aaf320bee93e6b2b7f9f
SHA5123d16c48fb339b93634bd36479de7ed97f50d6baa09b72c6e9644f214bebfcb472a457c07bab6e9b27426f29978314523c7edffdeff61a7022a93ebe1f27d06c6
-
Filesize
297KB
MD5cfce87b9aa05a33e252af0af9fbc2729
SHA16e010828b7e154ae76d38d65c3d6933ca33e85f5
SHA25601ed870dea991f17ddbaa2d96eb5a901fbdd03d61dfab8a380d502ed5f97ee84
SHA512d496d298a6d0dc2393a2e021bd873455de507f10414e1b452bdd12ea4ae9495ab2a6e21257c33e68c77d55748290c2e551a24c85298008f96f0036e703c19ba5
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB