Analysis
-
max time kernel
1s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 05:09
General
-
Target
91b0fe46f1948f02f86c4674ffcfb34836db231c7e67af53321b9f689bda3ea9.exe
-
Size
6.9MB
-
MD5
e91e63ea95a985eb5720f0f65ccd38db
-
SHA1
dfaa30b732b2831b305d05795a85a7e39429baef
-
SHA256
91b0fe46f1948f02f86c4674ffcfb34836db231c7e67af53321b9f689bda3ea9
-
SHA512
925bf6573c5db5df49ac9c71570fc1e1ba5ff54f280e38c1134825e16ced7e126e8792514034780cb114796be43c3ab08b6ccd22160fb77673fd25b736bfdc01
-
SSDEEP
196608:NA89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:9BmakyVnlUQ7Wz3Tv1jNTh0zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91b0fe46f1948f02f86c4674ffcfb34836db231c7e67af53321b9f689bda3ea9.exe"C:\Users\Admin\AppData\Local\Temp\91b0fe46f1948f02f86c4674ffcfb34836db231c7e67af53321b9f689bda3ea9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8S9E2.tmp\91b0fe46f1948f02f86c4674ffcfb34836db231c7e67af53321b9f689bda3ea9.tmp"C:\Users\Admin\AppData\Local\Temp\is-8S9E2.tmp\91b0fe46f1948f02f86c4674ffcfb34836db231c7e67af53321b9f689bda3ea9.tmp" /SL5="$A0064,6977575,54272,C:\Users\Admin\AppData\Local\Temp\91b0fe46f1948f02f86c4674ffcfb34836db231c7e67af53321b9f689bda3ea9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179KB
MD55183e579838397eff1d486f6e2cbc829
SHA1762d3fea08fbec611f6e41537fe7cf37c28b943f
SHA256abcd024d3e6b7d5699e1812d86f759fb00a01e256bdab3e3379cac5d875e7730
SHA5122f5b1672718accba565bec879d0bf1306fa672eeb13b8235b818784879e1d2a085de49f33704b45db57734054c809e59ecbfe0eb320728e40e6b846298cf37ee
-
Filesize
43KB
MD589416501c6e54631ed86d75ade5ea58c
SHA1cddb9195f84d0c7d19a8fe743a4d7a8a3984c4a1
SHA256f48b95832ff29ecde51ba8623da24e949fe5377ec9a39aae5b3f7ce0cefadd73
SHA5126f4ac1f3c09b7cb2904a3396db523c0531d15eaf5e231d941a2f9fd414ebd384449f5c6cc03f9964367a7ade6eb249146ede3f280965d66e8c160dff5a979416
-
Filesize
92KB
MD521caa044ceeacc7874bcfec162268312
SHA1daa1dfdb1c599d2c1395426d64fcf6e65d6008be
SHA2566d6389b3fda5d64eaaa8b383cd7e0cbb234c0a39c0aac44155a00c49525b8ec1
SHA512f5617572a023ebc546f6567a91b2d3f25c36ca19fa3632714bc8a7e75a7862d13eb10f54bbf99657ae157375707bca6af87434cb396ec38fcc181f07973cbf80
-
Filesize
32KB
MD5a7c7c3228521d81a1e863bb81daa149e
SHA1f3b54d8d6c919fbebbb46195873e88624ead21fe
SHA2563201deba453988ed530ba0061e18a0338d130bfbfe18720fadc549f96737cf8d
SHA512094fdfc77b2dc2e419c9d000a4367eccc2a07a6b90c4d16024d831261443fdc229915320516eb5927173edb0aedd36a09d4a086310d29a1fac698e730f115b10
-
Filesize
25KB
MD5c4b9f2e00f16de9b6ac1061da04d40ef
SHA165ca2994b6d400d974608da3f2f2c2944bf7203a
SHA25644c6f4a8cf77ba03c3563bebf5dec8d47a99205ac6c8c2a4185f5fd43a6edd19
SHA5129baf44e4d7cfdf760d9de468882835b4e69acb55ca10f964116a573b3f8b9eca66517aa18024e2e09f8bfa01f551f2410bd46736ebb00d035ad431954061419b
-
Filesize
1KB
MD530f56d3dcdbb4cee25cac7637364c580
SHA199fb8bc836254b3d273fde24225fdecbfbf58253
SHA25624925300046609e14788b5a383ecbf2b11eeb555bc8b2f99ed0729cf904e0128
SHA512183246d537305beb844dc9e9b62f400f7a565b38f014cf31962c373be5fff892b48dfeb59a552a15b94dee7d687c2bedcc3e283194a9e4244183e7bca1a1f121
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
11KB
MD5df5c8be6bcd94185a325c41c1a4f1825
SHA1de4d7a5c2af0e52d9a10737bb2c7bb2a19877f4b
SHA256ce577a9890ea322da1fbfca75fbece780be8f678f7a58836e5b8f4aebfe8e81e
SHA5129ca7a137eca714cdf6d0dfbd286f8ee50fb8dcbc8c767a90492c15174149c09af2d9cde30f13f7429f5b8d18e02bc1e66109db2b9bbc3d96b4b063cec4d8f4dd
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB