987f9f948e966c24b41683ca7af8b0af29aeb62a2a4df516c14ca4d47c1fdb15

Analysis

max time kernel
74s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

2.0MB
MD5

da3638acf41bb0da82a4cd5dc834d203
SHA1

62a555bc137ccb298ce605675ab2a314be323f8d
SHA256

987f9f948e966c24b41683ca7af8b0af29aeb62a2a4df516c14ca4d47c1fdb15
SHA512

218814f9c373bce49cd1e83e8837375320118100797541f96c91d6a037f97ba89dfd87f92d34760e9e4a6aa6ded20551cb726b775c396c68e466718a5948d16d
SSDEEP

24576:o7FUDowAyrTVE3U5FQjK63PkBjunqNHhSeLmByr/kOpgBAY7HQY5wq:oBuZrEUr63PcjunqZhSeLmzOW+YlB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1408	Setup.tmp

Loads dropped DLL 1 IoCs

pid	Process
1320	Setup.exe

Drops file in Program Files directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-multibyte-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-string-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-processenvironment-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-file-l1-2-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\Newtonsoft.Json.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-utility-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\deadcells.exe	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-file-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\ScriptTool.exe	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-profile-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-console-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-process-l1-1-0.dll	Setup.tmp
File created	C:\Program Files (x86)\Dead Cells\is-NP4LI.tmp	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\msvcp140.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-locale-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\vcruntime140.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-runtime-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-string-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-heap-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-processthreads-l1-1-1.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-time-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-stdio-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-environment-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-processthreads-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-datetime-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\Common.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-memory-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-namedpipe-l1-1-0.dll	Setup.tmp
File created	C:\Program Files (x86)\Dead Cells\unins000.dat	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-timezone-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\steam_api.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-convert-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-handle-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\CDBTool.exe	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-util-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-interlocked-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\PAKTool.exe	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\TmxTool\TmxTool.exe	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-synch-l1-2-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\AtlasTool.exe	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-filesystem-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-sysinfo-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\TmxTool\SDL2.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\libhl.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\TmxTool\OpenAL32.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-file-l2-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-conio-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-localization-l1-2-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ucrtbase.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-synch-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-private-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\ModTools\TmxTool\libhl.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-rtlsupport-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-math-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-errorhandling-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\d3dcompiler_47.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-crt-heap-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\OpenAL32.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\deadcells_gl.exe	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\SDL2.dll	Setup.tmp
File created	C:\Program Files (x86)\Dead Cells\is-U4CB6.tmp	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-debug-l1-1-0.dll	Setup.tmp
File opened for modification	C:\Program Files (x86)\Dead Cells\api-ms-win-core-libraryloader-l1-1-0.dll	Setup.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1408	Setup.tmp
1408	Setup.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1408	Setup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1408	1320	Setup.exe	28
PID 1320 wrote to memory of 1408	1320	Setup.exe	28
PID 1320 wrote to memory of 1408	1320	Setup.exe	28
PID 1320 wrote to memory of 1408	1320	Setup.exe	28
PID 1320 wrote to memory of 1408	1320	Setup.exe	28
PID 1320 wrote to memory of 1408	1320	Setup.exe	28
PID 1320 wrote to memory of 1408	1320	Setup.exe	28

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\is-9L2VP.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9L2VP.tmp\Setup.tmp" /SL5="$80122,1187328,0,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-9L2VP.tmp\Setup.tmp

Filesize
3.4MB

MD5
0a2249b158aee8b2e7f57445f7e491d5

SHA1
d2751197ffa9bde4f3928abcdbe7e4f651f63828

SHA256
e15be1a143a8376d9e12ab396d5aba3fa977435bdad5d3667b2e493686d8fe8c

SHA512
81ff07aee27fb77f58dc1c3b3eba0e8efbb37b855519c0ee7a94c9fb81727af794649dedd934e288abaf670a6236ee72dde3bff2a5620038da6009ea1bc389e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9L2VP.tmp\Setup.tmp

Filesize
3.4MB

MD5
0a2249b158aee8b2e7f57445f7e491d5

SHA1
d2751197ffa9bde4f3928abcdbe7e4f651f63828

SHA256
e15be1a143a8376d9e12ab396d5aba3fa977435bdad5d3667b2e493686d8fe8c

SHA512
81ff07aee27fb77f58dc1c3b3eba0e8efbb37b855519c0ee7a94c9fb81727af794649dedd934e288abaf670a6236ee72dde3bff2a5620038da6009ea1bc389e6

Download Submit
\Users\Admin\AppData\Local\Temp\is-9L2VP.tmp\Setup.tmp

Filesize
3.4MB

MD5
0a2249b158aee8b2e7f57445f7e491d5

SHA1
d2751197ffa9bde4f3928abcdbe7e4f651f63828

SHA256
e15be1a143a8376d9e12ab396d5aba3fa977435bdad5d3667b2e493686d8fe8c

SHA512
81ff07aee27fb77f58dc1c3b3eba0e8efbb37b855519c0ee7a94c9fb81727af794649dedd934e288abaf670a6236ee72dde3bff2a5620038da6009ea1bc389e6

Download Submit
memory/1320-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1320-55-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/1320-61-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/1320-64-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/1408-62-0x0000000074921000-0x0000000074923000-memory.dmp

Filesize
8KB

Download