Analysis
-
max time kernel
149s -
max time network
200s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-07-2021 12:55
Behavioral task
behavioral1
Sample
csgocheat.exe
Resource
win7v20210410
General
-
Target
csgocheat.exe
-
Size
692KB
-
MD5
2308cedb77f66e4a821d57e8ee1e08a5
-
SHA1
42ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
-
SHA256
8eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
-
SHA512
ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
secret92.ddns.net:8082
0c3398f1458
-
reg_key
0c3398f1458
-
splitter
@!#&^%$
Extracted
darkcomet
GG
secret92.ddns.net:82
DC_MUTEX-A6ET8RQ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
oqyLUmi211Cb
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
csgocheat.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" csgocheat.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
NJ.EXEmsdcsc.exepid process 1752 NJ.EXE 1444 msdcsc.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 860 notepad.exe -
Loads dropped DLL 4 IoCs
Processes:
csgocheat.exepid process 1032 csgocheat.exe 1032 csgocheat.exe 1032 csgocheat.exe 1032 csgocheat.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
csgocheat.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" csgocheat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1444 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csgocheat.exemsdcsc.exeNJ.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 1032 csgocheat.exe Token: SeSecurityPrivilege 1032 csgocheat.exe Token: SeTakeOwnershipPrivilege 1032 csgocheat.exe Token: SeLoadDriverPrivilege 1032 csgocheat.exe Token: SeSystemProfilePrivilege 1032 csgocheat.exe Token: SeSystemtimePrivilege 1032 csgocheat.exe Token: SeProfSingleProcessPrivilege 1032 csgocheat.exe Token: SeIncBasePriorityPrivilege 1032 csgocheat.exe Token: SeCreatePagefilePrivilege 1032 csgocheat.exe Token: SeBackupPrivilege 1032 csgocheat.exe Token: SeRestorePrivilege 1032 csgocheat.exe Token: SeShutdownPrivilege 1032 csgocheat.exe Token: SeDebugPrivilege 1032 csgocheat.exe Token: SeSystemEnvironmentPrivilege 1032 csgocheat.exe Token: SeChangeNotifyPrivilege 1032 csgocheat.exe Token: SeRemoteShutdownPrivilege 1032 csgocheat.exe Token: SeUndockPrivilege 1032 csgocheat.exe Token: SeManageVolumePrivilege 1032 csgocheat.exe Token: SeImpersonatePrivilege 1032 csgocheat.exe Token: SeCreateGlobalPrivilege 1032 csgocheat.exe Token: 33 1032 csgocheat.exe Token: 34 1032 csgocheat.exe Token: 35 1032 csgocheat.exe Token: SeIncreaseQuotaPrivilege 1444 msdcsc.exe Token: SeSecurityPrivilege 1444 msdcsc.exe Token: SeTakeOwnershipPrivilege 1444 msdcsc.exe Token: SeLoadDriverPrivilege 1444 msdcsc.exe Token: SeSystemProfilePrivilege 1444 msdcsc.exe Token: SeSystemtimePrivilege 1444 msdcsc.exe Token: SeProfSingleProcessPrivilege 1444 msdcsc.exe Token: SeIncBasePriorityPrivilege 1444 msdcsc.exe Token: SeCreatePagefilePrivilege 1444 msdcsc.exe Token: SeBackupPrivilege 1444 msdcsc.exe Token: SeRestorePrivilege 1444 msdcsc.exe Token: SeShutdownPrivilege 1444 msdcsc.exe Token: SeDebugPrivilege 1444 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1444 msdcsc.exe Token: SeChangeNotifyPrivilege 1444 msdcsc.exe Token: SeRemoteShutdownPrivilege 1444 msdcsc.exe Token: SeUndockPrivilege 1444 msdcsc.exe Token: SeManageVolumePrivilege 1444 msdcsc.exe Token: SeImpersonatePrivilege 1444 msdcsc.exe Token: SeCreateGlobalPrivilege 1444 msdcsc.exe Token: 33 1444 msdcsc.exe Token: 34 1444 msdcsc.exe Token: 35 1444 msdcsc.exe Token: SeDebugPrivilege 1752 NJ.EXE Token: 33 1752 NJ.EXE Token: SeIncBasePriorityPrivilege 1752 NJ.EXE Token: 33 1752 NJ.EXE Token: SeIncBasePriorityPrivilege 1752 NJ.EXE Token: 33 1752 NJ.EXE Token: SeIncBasePriorityPrivilege 1752 NJ.EXE Token: 33 1752 NJ.EXE Token: SeIncBasePriorityPrivilege 1752 NJ.EXE Token: 33 1752 NJ.EXE Token: SeIncBasePriorityPrivilege 1752 NJ.EXE Token: 33 1752 NJ.EXE Token: SeIncBasePriorityPrivilege 1752 NJ.EXE Token: 33 1752 NJ.EXE Token: SeIncBasePriorityPrivilege 1752 NJ.EXE Token: 33 1752 NJ.EXE Token: SeIncBasePriorityPrivilege 1752 NJ.EXE Token: 33 1752 NJ.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1444 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
csgocheat.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1032 wrote to memory of 1972 1032 csgocheat.exe cmd.exe PID 1032 wrote to memory of 1972 1032 csgocheat.exe cmd.exe PID 1032 wrote to memory of 1972 1032 csgocheat.exe cmd.exe PID 1032 wrote to memory of 1972 1032 csgocheat.exe cmd.exe PID 1032 wrote to memory of 1260 1032 csgocheat.exe cmd.exe PID 1032 wrote to memory of 1260 1032 csgocheat.exe cmd.exe PID 1032 wrote to memory of 1260 1032 csgocheat.exe cmd.exe PID 1032 wrote to memory of 1260 1032 csgocheat.exe cmd.exe PID 1972 wrote to memory of 1764 1972 cmd.exe attrib.exe PID 1972 wrote to memory of 1764 1972 cmd.exe attrib.exe PID 1972 wrote to memory of 1764 1972 cmd.exe attrib.exe PID 1972 wrote to memory of 1764 1972 cmd.exe attrib.exe PID 1032 wrote to memory of 1752 1032 csgocheat.exe NJ.EXE PID 1032 wrote to memory of 1752 1032 csgocheat.exe NJ.EXE PID 1032 wrote to memory of 1752 1032 csgocheat.exe NJ.EXE PID 1032 wrote to memory of 1752 1032 csgocheat.exe NJ.EXE PID 1260 wrote to memory of 1312 1260 cmd.exe attrib.exe PID 1260 wrote to memory of 1312 1260 cmd.exe attrib.exe PID 1260 wrote to memory of 1312 1260 cmd.exe attrib.exe PID 1260 wrote to memory of 1312 1260 cmd.exe attrib.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 860 1032 csgocheat.exe notepad.exe PID 1032 wrote to memory of 1444 1032 csgocheat.exe msdcsc.exe PID 1032 wrote to memory of 1444 1032 csgocheat.exe msdcsc.exe PID 1032 wrote to memory of 1444 1032 csgocheat.exe msdcsc.exe PID 1032 wrote to memory of 1444 1032 csgocheat.exe msdcsc.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe PID 1444 wrote to memory of 320 1444 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1764 attrib.exe 1312 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\csgocheat.exe"C:\Users\Admin\AppData\Local\Temp\csgocheat.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\csgocheat.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\csgocheat.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXE"C:\Users\Admin\AppData\Local\Temp\NJ.EXE"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"2⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
7033b44842fd35925e857497f9cb1653
SHA10db1543f4af1b37e9d3d93b75f5d8329d6337b3f
SHA256381bc1886d534d20d33107d09b09fd7e4fffba102c0314b6d8359be5ebb6231f
SHA512f74abf39181aa65068740d99968d503ce96bd2dc3c2a0a7251422204c7cda0aa54bc20edce2b37b264348cf97594ed3f99a31028a1eb9e17fd81b4ba4453de0f
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
7033b44842fd35925e857497f9cb1653
SHA10db1543f4af1b37e9d3d93b75f5d8329d6337b3f
SHA256381bc1886d534d20d33107d09b09fd7e4fffba102c0314b6d8359be5ebb6231f
SHA512f74abf39181aa65068740d99968d503ce96bd2dc3c2a0a7251422204c7cda0aa54bc20edce2b37b264348cf97594ed3f99a31028a1eb9e17fd81b4ba4453de0f
-
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
7033b44842fd35925e857497f9cb1653
SHA10db1543f4af1b37e9d3d93b75f5d8329d6337b3f
SHA256381bc1886d534d20d33107d09b09fd7e4fffba102c0314b6d8359be5ebb6231f
SHA512f74abf39181aa65068740d99968d503ce96bd2dc3c2a0a7251422204c7cda0aa54bc20edce2b37b264348cf97594ed3f99a31028a1eb9e17fd81b4ba4453de0f
-
\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
7033b44842fd35925e857497f9cb1653
SHA10db1543f4af1b37e9d3d93b75f5d8329d6337b3f
SHA256381bc1886d534d20d33107d09b09fd7e4fffba102c0314b6d8359be5ebb6231f
SHA512f74abf39181aa65068740d99968d503ce96bd2dc3c2a0a7251422204c7cda0aa54bc20edce2b37b264348cf97594ed3f99a31028a1eb9e17fd81b4ba4453de0f
-
memory/320-80-0x0000000000000000-mapping.dmp
-
memory/320-84-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/860-82-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/860-73-0x0000000000000000-mapping.dmp
-
memory/1032-60-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1032-71-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1260-62-0x0000000000000000-mapping.dmp
-
memory/1312-68-0x0000000000000000-mapping.dmp
-
memory/1444-77-0x0000000000000000-mapping.dmp
-
memory/1444-83-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1752-72-0x0000000001EC0000-0x0000000001EC1000-memory.dmpFilesize
4KB
-
memory/1752-66-0x0000000000000000-mapping.dmp
-
memory/1764-63-0x0000000000000000-mapping.dmp
-
memory/1972-61-0x0000000000000000-mapping.dmp