Malware Analysis Report

2025-01-02 06:57

Sample ID 221220-my2ewsce3t
Target Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe
SHA256 539304ee93b2f6872d2474d7a217986864f82e0acfd8f1a73fb8d303ec6e72f1
Tags
r77
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

539304ee93b2f6872d2474d7a217986864f82e0acfd8f1a73fb8d303ec6e72f1

Threat Level: Known bad

The file Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe was found to be: Known bad.

Malicious Activity Summary

r77

R77 family

r77 rootkit payload

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2022-12-20 10:53

Signatures

R77 family

r77

r77 rootkit payload

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-12-20 10:53

Reported

2022-12-20 10:56

Platform

win10-20220901-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe

"C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v1.03-v1.6 Plus 32 Trainer.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 flingtrainer.com udp
N/A 8.8.8.8:53 flingtrainer.com udp
N/A 8.8.8.8:53 flingtrainer.com udp
N/A 20.189.173.5:443 tcp
N/A 178.79.208.1:80 tcp

Files

memory/2764-117-0x000001B12E520000-0x000001B12E552000-memory.dmp

memory/2764-118-0x000001B14E4F0000-0x000001B14E4F8000-memory.dmp

memory/2764-119-0x000001B14D1E0000-0x000001B14D218000-memory.dmp