GlowStorm
Overview
overview
8Static
static
8monirs4mia...me.dll
windows7-x64
8monirs4mia...me.dll
windows10-2004-x64
8monirs4mia...er.exe
windows7-x64
1monirs4mia...er.exe
windows10-2004-x64
1monirs4mia...��.url
windows7-x64
1monirs4mia...��.url
windows10-2004-x64
1monirs4mia...��.url
windows7-x64
1monirs4mia...��.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
monirs4mianOriginbd/Crack/Game/Bin/3dmgame.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
monirs4mianOriginbd/Crack/Game/Bin/3dmgame.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
monirs4mianOriginbd/Crack/Game/Bin/The.Sims.4.Launcher.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
monirs4mianOriginbd/Crack/Game/Bin/The.Sims.4.Launcher.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
monirs4mianOriginbd/下载说明.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
monirs4mianOriginbd/下载说明.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
monirs4mianOriginbd/西西单机游戏.url
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
monirs4mianOriginbd/西西单机游戏.url
Resource
win10v2004-20220812-en
General
-
Target
120e18c0e48502dc0027c7fa5dc7abf868f034f9003f2576863e2f871dc11d9a
-
Size
980KB
-
MD5
d0e49c4d864e278e2ca0a975a2d1c0be
-
SHA1
e69fd746b19401ec0a1d277951b98371ff7b6a76
-
SHA256
120e18c0e48502dc0027c7fa5dc7abf868f034f9003f2576863e2f871dc11d9a
-
SHA512
c496b10dbf9dae154c1535f1b9cd6c5921fb6beec797008e30e4ff3ab9a8859c734f3f151ca0511d80d6510e10d94d98e46b43a6768bef6f9ef7195b8dd038b2
-
SSDEEP
24576:e/iarb+yLT+6dwR2AWnsQQHmpIvt6qKkPtF:ara+ndwRMJVpstww
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/monirs4mianOriginbd/Crack/Game/Bin/3dmgame.dll vmprotect
Files
-
120e18c0e48502dc0027c7fa5dc7abf868f034f9003f2576863e2f871dc11d9a.zip
-
monirs4mianOriginbd/Crack/Game/Bin/3dmgame.dll.dll windows x86
aa244998f1fd994cfd873b8b3d5e1b76
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ResumeThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
shell32
SHGetSpecialFolderPathW
ole32
CoCreateInstance
oleaut32
SysAllocString
msvcr100
__CxxFrameHandler3
msvcp100
?_Xlength_error@std@@YAXPBD@Z
shlwapi
PathAppendW
Exports
Exports
Sections
.text Size: - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 569KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 676KB - Virtual size: 676KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
monirs4mianOriginbd/Crack/Game/Bin/3dmgame.ini
-
monirs4mianOriginbd/Crack/Game/Bin/The.Sims.4.Launcher.exe.exe windows x86
beb107aa3888a0b1979dd3b648d63d45
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
lstrlenA
GetStartupInfoA
CreateProcessA
VirtualAllocEx
WriteProcessMemory
GetProcAddress
GetModuleHandleA
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
ResumeThread
GetCurrentDirectoryA
GetPrivateProfileStringA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
HeapSetInformation
InterlockedCompareExchange
GetSystemTimeAsFileTime
Sleep
InterlockedExchange
msvcr100
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
__set_app_type
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
sprintf
_fmode
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 494KB - Virtual size: 494KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
monirs4mianOriginbd/下载说明.url.url
-
monirs4mianOriginbd/西西单机游戏.txt
-
monirs4mianOriginbd/西西单机游戏.url.url