Overview
overview
8Static
static
(fix depen...et.bat
windows7-x64
8(fix depen...et.bat
windows10-2004-x64
8CLEO.dll
windows7-x64
3CLEO.dll
windows10-2004-x64
3CLEO/CLEO+.dll
windows7-x64
1CLEO/CLEO+.dll
windows10-2004-x64
1CLEO/FileS...ns.dll
windows7-x64
1CLEO/FileS...ns.dll
windows10-2004-x64
1CLEO/IniFiles.dll
windows7-x64
1CLEO/IniFiles.dll
windows10-2004-x64
1CLEO/IntOp...ns.dll
windows7-x64
1CLEO/IntOp...ns.dll
windows10-2004-x64
1CrashInfo.SA.dll
windows7-x64
3CrashInfo.SA.dll
windows10-2004-x64
3_noDEP.dll
windows7-x64
1_noDEP.dll
windows10-2004-x64
1bass.dll
windows7-x64
1bass.dll
windows10-2004-x64
1gta_sa.exe
windows7-x64
1gta_sa.exe
windows10-2004-x64
1gta_sa.pdb
windows7-x64
3gta_sa.pdb
windows10-2004-x64
3libcurl.dll
windows7-x64
1libcurl.dll
windows10-2004-x64
1modloader.dll
windows7-x64
1modloader.dll
windows10-2004-x64
1modloader/...si.dll
windows7-x64
3modloader/...si.dll
windows10-2004-x64
3modloader/...nk.dll
windows7-x64
3modloader/...nk.dll
windows10-2004-x64
3modloader/...ta.dll
windows7-x64
3modloader/...ta.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2022 00:06
Static task
static1
Behavioral task
behavioral1
Sample
(fix dependencies)/(remove GameUX)/gameux_delet.bat
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
(fix dependencies)/(remove GameUX)/gameux_delet.bat
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
CLEO.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
CLEO.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
CLEO/CLEO+.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
CLEO/CLEO+.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
CLEO/FileSystemOperations.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
CLEO/FileSystemOperations.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
CLEO/IniFiles.dll
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
CLEO/IniFiles.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
CLEO/IntOperations.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
CLEO/IntOperations.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
CrashInfo.SA.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
CrashInfo.SA.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
_noDEP.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
_noDEP.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
bass.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
bass.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
gta_sa.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
gta_sa.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
gta_sa.pdb
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
gta_sa.pdb
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
libcurl.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
libcurl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
modloader.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
modloader.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
modloader/.data/plugins/gta3/std.asi.dll
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
modloader/.data/plugins/gta3/std.asi.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
modloader/.data/plugins/gta3/std.bank.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
modloader/.data/plugins/gta3/std.bank.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
modloader/.data/plugins/gta3/std.data.dll
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
modloader/.data/plugins/gta3/std.data.dll
Resource
win10v2004-20220812-en
General
-
Target
CrashInfo.SA.dll
-
Size
449KB
-
MD5
2ff14ecd0de8dd893dac16c72b6488a1
-
SHA1
24ab165560f92784701ef56d643923c98e8b1156
-
SHA256
98d6277dafd1915795527fc23cfeebd58fae87f4c269761defcaea766156992e
-
SHA512
4ebf323ee7ad8ffabe794ea00239cea8ebcdb697cd73cd87b6f840c42cbf5a437beeb7820d07ec17677ab6f6613f6bd317bd29fa527729c31e0e3425e6654427
-
SSDEEP
12288:hwuyGdPHY7vsijRsI5yO8pzBlonudLZ2RMGhBlaCJ:htHOvsijRsI5YtZ2qMl
Malware Config
Signatures
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2912 4308 WerFault.exe rundll32.exe 1608 4308 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 744 wrote to memory of 4308 744 rundll32.exe rundll32.exe PID 744 wrote to memory of 4308 744 rundll32.exe rundll32.exe PID 744 wrote to memory of 4308 744 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashInfo.SA.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashInfo.SA.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 6043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 8323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4308 -ip 43081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4308 -ip 43081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4308-132-0x0000000000000000-mapping.dmp