323634d8c61be01b65f77418210092192e5685336d255b9052965060c64a598e

Analysis

max time kernel
35s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 08:48

Target

MetaWorld/Meta World Launcher beta.exe
Size

714.9MB
MD5

96d65eabe7288c7590f44795a9822823
SHA1

080df69b94e4e7afcafd935c71098ba62aafad4d
SHA256

6cddbdcb02b77f840aa179df779d702c805fe48cf5b6425d062ade87450e705e
SHA512

b3b84c329a85f1ac9c70927bab5df924c1306ee6907ae483396c85705bf86211941b8d7423acc15a4f90cfeee69d5ae7a04504d4391e0225ba70f44318e84a40
SSDEEP

98304:MJmvB+wUnhopFNE8yCE+8t7PxBTylOqtKQCHb/i+E:gYin6pU8yCE+8FxBTH9QC7d

Score

6^/10

spyware

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 1204 AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1204	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Meta World Launcher beta.exe

description	pid	process	target process
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe
PID 1652 wrote to memory of 1204	1652	Meta World Launcher beta.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\MetaWorld\Meta World Launcher beta.exe
"C:\Users\Admin\AppData\Local\Temp\MetaWorld\Meta World Launcher beta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/1204-58-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1204-59-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1204-61-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1204-63-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1204-64-0x0000000000000000-mapping.dmp

Download
memory/1204-66-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1204-65-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1204-68-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1204-70-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/1652-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x0000000000100000-0x0000000000775000-memory.dmp

Filesize
6.5MB

Download