Analysis
-
max time kernel
577s -
max time network
598s -
platform
windows10-1703_x64 -
resource
win10-20220812-de -
resource tags
arch:x64arch:x86image:win10-20220812-delocale:de-deos:windows10-1703-x64systemwindows -
submitted
23-11-2022 06:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/UWUFN/LithiumGS/raw/main/Lithium%20Gameserver.rar
Resource
win10-20220812-de
Behavioral task
behavioral2
Sample
https://github.com/UWUFN/LithiumGS/raw/main/Lithium%20Gameserver.rar
Resource
win10v2004-20221111-de
General
-
Target
https://github.com/UWUFN/LithiumGS/raw/main/Lithium%20Gameserver.rar
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Signatures
-
Modifies system executable filetype association 2 TTPs 8 IoCs
Processes:
uninstall.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
winrar-x64-611.exeuninstall.exeWinRAR.exeLithium.exepid process 4068 winrar-x64-611.exe 1152 uninstall.exe 2064 WinRAR.exe 4604 Lithium.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
uninstall.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 3112 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 60 IoCs
Processes:
winrar-x64-611.exeuninstall.exedescription ioc process File created C:\Program Files\WinRAR\ReadMe.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\Zip.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-611.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File created C:\Program Files\WinRAR\Rar.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File created C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File created C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-611.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240666796 winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File created C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Order.htm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Resources.pri winrar-x64-611.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Modifies registry class 64 IoCs
Processes:
uninstall.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r07\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r19 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r00 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r17\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r14 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r20 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r23\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r01 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r18 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r28 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r11\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r18\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r27 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r09\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r17 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r12 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" uninstall.exe -
NTFS ADS 2 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\Downloads\Lithium Gameserver.rar:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\winrar-x64-611.exe:Zone.Identifier firefox.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WinRAR.exepid process 2064 WinRAR.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 2168 firefox.exe Token: SeDebugPrivilege 2168 firefox.exe Token: SeDebugPrivilege 2168 firefox.exe Token: SeDebugPrivilege 2168 firefox.exe Token: SeDebugPrivilege 2168 firefox.exe Token: SeDebugPrivilege 2168 firefox.exe Token: SeDebugPrivilege 2168 firefox.exe Token: SeDebugPrivilege 2168 firefox.exe -
Suspicious use of FindShellTrayWindow 24 IoCs
Processes:
firefox.exeWinRAR.exepid process 2168 firefox.exe 2168 firefox.exe 2168 firefox.exe 2168 firefox.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe 2064 WinRAR.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 2168 firefox.exe 2168 firefox.exe 2168 firefox.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
firefox.exewinrar-x64-611.exeuninstall.exeWinRAR.exepid process 2168 firefox.exe 2168 firefox.exe 2168 firefox.exe 2168 firefox.exe 4068 winrar-x64-611.exe 4068 winrar-x64-611.exe 4068 winrar-x64-611.exe 1152 uninstall.exe 2064 WinRAR.exe 2064 WinRAR.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 2064 wrote to memory of 2168 2064 firefox.exe firefox.exe PID 2064 wrote to memory of 2168 2064 firefox.exe firefox.exe PID 2064 wrote to memory of 2168 2064 firefox.exe firefox.exe PID 2064 wrote to memory of 2168 2064 firefox.exe firefox.exe PID 2064 wrote to memory of 2168 2064 firefox.exe firefox.exe PID 2064 wrote to memory of 2168 2064 firefox.exe firefox.exe PID 2064 wrote to memory of 2168 2064 firefox.exe firefox.exe PID 2064 wrote to memory of 2168 2064 firefox.exe firefox.exe PID 2064 wrote to memory of 2168 2064 firefox.exe firefox.exe PID 2168 wrote to memory of 2592 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 2592 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 5100 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe PID 2168 wrote to memory of 1356 2168 firefox.exe firefox.exe
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/UWUFN/LithiumGS/raw/main/Lithium%20Gameserver.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/UWUFN/LithiumGS/raw/main/Lithium%20Gameserver.rar2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.0.1432981287\162405136" -parentBuildID 20200403170909 -prefsHandle 1548 -prefMapHandle 1540 -prefsLen 1 -prefMapSize 220115 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 1624 gpu3⤵PID:2592
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.3.528693376\1192790348" -childID 1 -isForBrowser -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 156 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 2240 tab3⤵PID:5100
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.13.2140318964\990317783" -childID 2 -isForBrowser -prefsHandle 3348 -prefMapHandle 3344 -prefsLen 6938 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 3360 tab3⤵PID:1356
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4912
-
C:\Users\Admin\Downloads\winrar-x64-611.exe"C:\Users\Admin\Downloads\winrar-x64-611.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4068 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1152
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Lithium Gameserver.rar"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2064
-
C:\Users\Admin\Documents\Lithium Gameserver\Lithium.exe"C:\Users\Admin\Documents\Lithium Gameserver\Lithium.exe"1⤵
- Executes dropped EXE
PID:4604 -
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\44DA.tmp\44FA.tmp\44FB.bat "C:\Users\Admin\Documents\Lithium Gameserver\Lithium.exe""2⤵PID:3680
-
C:\Windows\system32\mode.commode con lines=30 cols=803⤵PID:2748
-
C:\Windows\system32\chcp.comchcp 650013⤵PID:4160
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD58933d6e810668af29d7ba8f1c3b2b9ff
SHA1760cbb236c4ca6e0003582aaefd72ff8b1c872aa
SHA256cd3ba458c88bdf8924ebb404c8505d627e6ac7aadc6e351562c1894019604fc7
SHA512344d737228483add83d5f2b31ae9582ca78013dc4be967f2cdafca24145970e3cb46d75373996150a3c9119ebc81ce9ac50e16696c17a4dea65c9571ef8e745e
-
Filesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
Filesize
95KB
MD5d4c768c52ee077eb09bac094f4af8310
SHA1c56ae6b4464799fcdc87c5ff5a49ac1ad43482b1
SHA2568089dfbebdf2142c7f60f5c12098859417b3c997f0b24b696ccaa78a50f3726c
SHA5125b794b19b5ff10f7356a46f02204d0df3183037bc89d32e3f2c2978ea8f90ac6367fcb225b476cb7c8a3035d82ca1e328791271d3a58b40b9759d4b65e83f847
-
Filesize
314KB
MD581b236ef16aaa6a3936fd449b12b82a2
SHA1698acb3c862c7f3ecf94971e4276e531914e67bc
SHA256d37819e64ecb61709fcf3435eb9bed790f75163057e36fb94a3465ca353ccc5e
SHA512968fe20d6fe6879939297b8683da1520a1e0d2b9a5107451fca70b91802492e243976f56090c85eb9f38fca8f74134b8b6aa133ba2e2806d763c9f8516ace769
-
Filesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
Filesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
Filesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
Filesize
11KB
MD5d300eed487e0efce9ff56e59aa0266ca
SHA1f559c1adb41692ee86360f61a8b8c56440543f40
SHA2567cf51a0e137d990a450245c48f027f1daea4d159a5226d192253732ac32b290f
SHA5126777a0324ce6166bb8f786a2d863e050dd8b76b621fc29e725143c802ec43c87fd93df160e184824a7f86085a3da9acbcc1c373dbd41afc7836a85f539d97f6e
-
Filesize
108KB
MD52e0c48c3eace5be3df1f7e70cba0eb39
SHA1a8746f8fe786b2698a6f422ab0273b2f4a16c9fe
SHA2569b3c9b8aa52db5aeaf2612e2b1d3cb73c8f794fa51a93151289f3fe5ef211067
SHA512b886436da15e07da993f622925b2b9071b60775780c319242fc4bdcfad1dbfa8fb76323cf5351766da32402117764d83933a90dfdb725c0c65b492a004fdd292
-
Filesize
108KB
MD52e0c48c3eace5be3df1f7e70cba0eb39
SHA1a8746f8fe786b2698a6f422ab0273b2f4a16c9fe
SHA2569b3c9b8aa52db5aeaf2612e2b1d3cb73c8f794fa51a93151289f3fe5ef211067
SHA512b886436da15e07da993f622925b2b9071b60775780c319242fc4bdcfad1dbfa8fb76323cf5351766da32402117764d83933a90dfdb725c0c65b492a004fdd292
-
Filesize
2.5MB
MD59f6587f122a4fa8ff732d87820fd9532
SHA1c968129051290c2efc548779a2c2882872b3af00
SHA256fd2565de45ec3d48cf4448ba36a99510b156aa4b61b0b2468baa7bde8fc4b6ec
SHA512482ddf5ef9a31d54abf73a47771802aa859a813beb7b2495331af398f5408919b24d6d3c0497e81e93b29c530b5b815e5cadfa8738d1565f404de8aa1480d5c9
-
Filesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
Filesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
Filesize
608B
MD5773b9bd2f5fd9e540c01e02a03bbbcef
SHA1ed50fe788477d55e4410e574b2e01ee38daddede
SHA256b4fa52fa3d0734555d12e3241935ed8f05dddbb324deadcf85b1ff5d99ff83ec
SHA5122c2900357e963bebb5471e23b2eae62c5164d652e31ba5b954aa814ca176f43d5d4a6ea08d688476f1d19c879a0184e5ff1b1c9103906d47275281a300e2ca10
-
Filesize
632KB
MD5650a771d005941c7a23926011d75ad8f
SHA184b346acd006f21d7ffb8d5ea5937ec0ee3daa4f
SHA256b28d116dd3066e7a3c9f0cc2f63d34a7189c9d78e869d1255c9dec59172a9d5f
SHA5124724bd81c26716f0ad59187c78fbb920fd8b251540e76c28d93e0afcce3ebe0e3e2b4605e9d444bbbc3e828ce11f2b73489404318ab11403eff94b42ef2c9bad