snakebot | c9ae7f8a79a27955d93c32f1b9fc3100496f4cdb6acfa848e80acabca6d1749f

Resubmissions

13-03-2023 06:29

230313-g841waah6v 10

13-03-2023 05:52

230313-gk2wlsgg73 10

13-03-2023 05:45

230313-gfsr5sgg57 7

Analysis

max time kernel
195s
max time network
34s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
13-03-2023 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

120.1MB
MD5

5fb9b3c109ad471d0bc148329344e8ca
SHA1

21f2a06e7f83cb2886c16cafc20968f370fa2643
SHA256

c9ae7f8a79a27955d93c32f1b9fc3100496f4cdb6acfa848e80acabca6d1749f
SHA512

b50c9420e0709391be280b4f65be35bde9018388872c4ad675f104fd0093be22159a74b0d46b0d1c92043887824cb97464db452d422bcd339a1f3578b3f7456c
SSDEEP

1572864:uiM7DhczCaxWLABs8spKCFLme+A2akcvAYBkbKiD5DEeM9VCwQdUzk+:ulOCaELAO8WLiA2aTVkbKidc9IdUz/

Score

10^/10

snakebot discovery snakebot

Malware Config

Signatures

SnakeBOT
SnakeBOT is a heavily obfuscated .NET downloader.
snakebot

Contains SnakeBOT related strings 1 IoCs

snakebot

Processes:

resource	yara_rule
C:\Program Files (x86)\Undertale\data.win	snakebot_strings

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Program Files (x86)\Undertale\steam_api.dll	acprotect
C:\Program Files (x86)\Undertale\steam_api.dll	acprotect
\Program Files (x86)\Undertale\steam_api.dll	acprotect

Executes dropped EXE 3 IoCs

Processes:

Setup.tmpUNDERTALE_original.exeUNDERTALE_original.exe

pid process

1096 Setup.tmp
1124 UNDERTALE_original.exe
1744 UNDERTALE_original.exe

Loads dropped DLL 20 IoCs

Processes:

Setup.exeSetup.tmpUNDERTALE_original.exeWerFault.exeUNDERTALE_original.exeWerFault.exe

pid	process
608	Setup.exe
1096	Setup.tmp
1124	UNDERTALE_original.exe
1124	UNDERTALE_original.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1744	UNDERTALE_original.exe
1744	UNDERTALE_original.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

Setup.tmp

description	ioc	process
File created	C:\Program Files (x86)\Undertale\is-22ARB.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-R4MCH.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-SAQQ4.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-RAB1P.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-FH1RE.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-AL01G.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-SJN2M.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-9U6F0.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-Q3M6E.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-K27A8.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-KAPC4.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-T353M.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-U7CSA.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-VAMD1.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-SQ844.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-NLJN3.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-LCI6N.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-0HFOT.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-KDS1H.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-ACQH0.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-QFR1L.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-1476T.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-FVQLJ.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-T8KKU.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-GFKIP.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-4841O.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-7058A.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-EOUT7.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-GKQMN.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-P6T4A.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-7TNOK.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-6I1K1.tmp	Setup.tmp
File opened for modification	C:\Program Files (x86)\Undertale\D3DX9_43.dll	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-JH6B8.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-85JDG.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-9EO5T.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-QTB6O.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-JL6NT.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-R35OO.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-M4I2Q.tmp	Setup.tmp
File opened for modification	C:\Program Files (x86)\Undertale\steam_api.dll	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-09IR8.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-A0QO2.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-KT29P.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-SRCBA.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-ISGEJ.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-52SH1.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-DIJH6.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-DU2PT.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-H0ABT.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-IBRGA.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-EN9V3.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-4HM11.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-QCTO1.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-HI13P.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-BH92O.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-HG0U3.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-BH3LG.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-AP1K1.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-2QN8C.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-VAPI4.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-2M3KP.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-G97OV.tmp	Setup.tmp
File created	C:\Program Files (x86)\Undertale\is-I0628.tmp	Setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1156 1124 WerFault.exe UNDERTALE_original.exe
1972 1744 WerFault.exe UNDERTALE_original.exe

pid	pid_target	process	target process
1156	1124	WerFault.exe	UNDERTALE_original.exe
1972	1744	WerFault.exe	UNDERTALE_original.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

Setup.tmpUNDERTALE_original.exeUNDERTALE_original.exe

pid	process
1096	Setup.tmp
1096	Setup.tmp
1124	UNDERTALE_original.exe
1124	UNDERTALE_original.exe
1124	UNDERTALE_original.exe
1124	UNDERTALE_original.exe
1124	UNDERTALE_original.exe
1124	UNDERTALE_original.exe
1744	UNDERTALE_original.exe
1744	UNDERTALE_original.exe
1744	UNDERTALE_original.exe
1744	UNDERTALE_original.exe
1744	UNDERTALE_original.exe
1744	UNDERTALE_original.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Setup.tmp

pid process

1096 Setup.tmp

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Setup.exeUNDERTALE_original.exeUNDERTALE_original.exe

description	pid	process	target process
PID 608 wrote to memory of 1096	608	Setup.exe	Setup.tmp
PID 608 wrote to memory of 1096	608	Setup.exe	Setup.tmp
PID 608 wrote to memory of 1096	608	Setup.exe	Setup.tmp
PID 608 wrote to memory of 1096	608	Setup.exe	Setup.tmp
PID 608 wrote to memory of 1096	608	Setup.exe	Setup.tmp
PID 608 wrote to memory of 1096	608	Setup.exe	Setup.tmp
PID 608 wrote to memory of 1096	608	Setup.exe	Setup.tmp
PID 1124 wrote to memory of 1156	1124	UNDERTALE_original.exe	WerFault.exe
PID 1124 wrote to memory of 1156	1124	UNDERTALE_original.exe	WerFault.exe
PID 1124 wrote to memory of 1156	1124	UNDERTALE_original.exe	WerFault.exe
PID 1124 wrote to memory of 1156	1124	UNDERTALE_original.exe	WerFault.exe
PID 1744 wrote to memory of 1972	1744	UNDERTALE_original.exe	WerFault.exe
PID 1744 wrote to memory of 1972	1744	UNDERTALE_original.exe	WerFault.exe
PID 1744 wrote to memory of 1972	1744	UNDERTALE_original.exe	WerFault.exe
PID 1744 wrote to memory of 1972	1744	UNDERTALE_original.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:608

C:\Users\Admin\AppData\Local\Temp\is-D4BRT.tmp\Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-D4BRT.tmp\Setup.tmp" /SL5="$70132,124988605,836608,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1096

C:\Program Files (x86)\Undertale\UNDERTALE_original.exe
"C:\Program Files (x86)\Undertale\UNDERTALE_original.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 440
2⤵
- Loads dropped DLL
- Program crash
PID:1156

C:\Program Files (x86)\Undertale\UNDERTALE_original.exe
"C:\Program Files (x86)\Undertale\UNDERTALE_original.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 440
2⤵
- Loads dropped DLL
- Program crash
PID:1972

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
C:\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
C:\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
C:\Program Files (x86)\Undertale\d3dx9_43.dll
Filesize
1.9MB

MD5
86e39e9161c3d930d93822f1563c280d

SHA1
f5944df4142983714a6d9955e6e393d9876c1e11

SHA256
0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f

SHA512
0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3

Download Submit
C:\Program Files (x86)\Undertale\data.win
Filesize
55.2MB

MD5
a7728805e9789cb1288e6d807aa46833

SHA1
9c07858aa3ea04319644cc246d04ffa2dd77323c

SHA256
36e4544d49fbba8f484cd1c629085d240139b54e07dab6a466f0dd36f1753e98

SHA512
f8f54db54d921eff62327733d8a4811dc1c0e5c0fd3b9c898a84cdfeba513ec8e9dde2a333ef411b0190106c80e0a2a1776dc927d3ad9e62d0b515999690237d

Download Submit
C:\Program Files (x86)\Undertale\is-LR0FO.tmp
Filesize
3.7MB

MD5
62adbbb61850a3883c15a29a0d08df86

SHA1
835a9f036668f592d49d790eb933d706097ddf01

SHA256
71663af422d47908711fca5d24b4244b9eef78e1f2a45214ee59b14712de5500

SHA512
a95b0afe81fd4535959da755f468672c8abd2215522ac324a156f47b3eed485b4589724ed9f51b3d78939afedf94d4afb9463ab256b54b2b5d65c7acc67359d3

Download Submit
C:\Program Files (x86)\Undertale\options.ini
Filesize
97B

MD5
396f73a1185a5642f5f1e2538b64396a

SHA1
d72d687a5a1258986f218bfccacc6118c39ec4f9

SHA256
e267293f58d257d2dd1e00ad25425bdb798fcbf75256a7d45b7d7086159dbc58

SHA512
e17cfca14ce79c71eea01973385fa4151989d40bfc5a04b97fd3534ff5b4f04b385d11867d80a60325aa0bd13403910fee73ab9379f0e05c669d24d5d95957da

Download Submit
C:\Program Files (x86)\Undertale\steam_api.dll
Filesize
251KB

MD5
23767288e6a003aaaa54355cbe108da8

SHA1
c7f21dc71491fe661c698f5c561405c0e3f423c1

SHA256
209135c082a8ef8323479384e97d769d9b2d98f727bbb34a7806ce150b750c89

SHA512
a870b2f99da48ad07f9b36d6730d74af5f285af12e21a24d61e6e3023d5917920bd343fe295b7374a2065bf9c09b6f1cbb03fbcf05206f4bd0544b5f0eb0e147

Download Submit
C:\Program Files (x86)\Undertale\steam_emu.ini
Filesize
2KB

MD5
f98efa05e4c224bec6df0f38c1f41801

SHA1
b73f247e46657c5e78c410d7d5bef50dac8c172e

SHA256
303cfb51ad5a389296c7c86e4aea6d450276078d40d848df4a334e70d5b77885

SHA512
13bad72f40efb3ca91bc28490974af4a7a40c6da5b11ae2f277cc24def56c32b2f9381b09c11a028e5bd27966f88085eb98aebb6f81e7893efdd76bc3981cf4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D4BRT.tmp\Setup.tmp
Filesize
2.5MB

MD5
d9bc11c23aa360311d6b237b23b0c4fd

SHA1
2f6bca0a9d09a1928f139a8a2e0cc872f4284fe7

SHA256
88e4053e376c6597edc6533584b2f2fa3905237fe5db61867e8ee71c3a9e9f5d

SHA512
732b217963e415fb272556731cf8503df431dbc450f6caf59b7c47804c650baebd33735d9fee18537bac37d639f4491a168351fa4b431457f62bae0e219de6fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D4BRT.tmp\Setup.tmp
Filesize
2.5MB

MD5
d9bc11c23aa360311d6b237b23b0c4fd

SHA1
2f6bca0a9d09a1928f139a8a2e0cc872f4284fe7

SHA256
88e4053e376c6597edc6533584b2f2fa3905237fe5db61867e8ee71c3a9e9f5d

SHA512
732b217963e415fb272556731cf8503df431dbc450f6caf59b7c47804c650baebd33735d9fee18537bac37d639f4491a168351fa4b431457f62bae0e219de6fa

Download Submit
C:\Users\Public\Documents\Steam\CODEX\391540\achievements.ini
Filesize
32B

MD5
7ebba17ad01ef8b82fe01c5a15a31634

SHA1
29f8ac51d89a7d3f300e765685f5230edb0c9752

SHA256
bd583fdedda922bfc385b7872db9329d4d61c4548852fa8207ebe72b5af8eb2e

SHA512
05bdb5e1d7e4429c0b33b13fd29f43b92d174260480348e12fb3dbe0f603dc44146db142cbf3bbc5ef09e6f7d86a269abba15d4ce0a80bffa9c38e31af33e04e

Download Submit
C:\Users\Public\Documents\Steam\CODEX\391540\leaderboards.ini
Filesize
32B

MD5
d03f6a84b07a97dd09a27efb9acd8d1d

SHA1
3e27d5f859bdd0822dfacdb5510ee88dd2834496

SHA256
749be0285d916625e06e0b5273889c2ede421b1f16f765cf817870fcec8c2930

SHA512
659db10eb03cb17a4dea5190889d9723a7a7cb705b11685f5912f3ea667375ae2502e5c6101b07687ef48f03902e9b1fa890c9e328947626528dca485a21018a

Download Submit
\Program Files (x86)\Undertale\D3DX9_43.dll
Filesize
1.9MB

MD5
86e39e9161c3d930d93822f1563c280d

SHA1
f5944df4142983714a6d9955e6e393d9876c1e11

SHA256
0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f

SHA512
0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3

Download Submit
\Program Files (x86)\Undertale\D3DX9_43.dll
Filesize
1.9MB

MD5
86e39e9161c3d930d93822f1563c280d

SHA1
f5944df4142983714a6d9955e6e393d9876c1e11

SHA256
0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f

SHA512
0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\UNDERTALE_original.exe
Filesize
3.6MB

MD5
93d87952773a2bb59a8667d0bc06c2c0

SHA1
480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5

SHA256
9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b

SHA512
d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d

Download Submit
\Program Files (x86)\Undertale\steam_api.dll
Filesize
251KB

MD5
23767288e6a003aaaa54355cbe108da8

SHA1
c7f21dc71491fe661c698f5c561405c0e3f423c1

SHA256
209135c082a8ef8323479384e97d769d9b2d98f727bbb34a7806ce150b750c89

SHA512
a870b2f99da48ad07f9b36d6730d74af5f285af12e21a24d61e6e3023d5917920bd343fe295b7374a2065bf9c09b6f1cbb03fbcf05206f4bd0544b5f0eb0e147

Download Submit
\Program Files (x86)\Undertale\steam_api.dll
Filesize
251KB

MD5
23767288e6a003aaaa54355cbe108da8

SHA1
c7f21dc71491fe661c698f5c561405c0e3f423c1

SHA256
209135c082a8ef8323479384e97d769d9b2d98f727bbb34a7806ce150b750c89

SHA512
a870b2f99da48ad07f9b36d6730d74af5f285af12e21a24d61e6e3023d5917920bd343fe295b7374a2065bf9c09b6f1cbb03fbcf05206f4bd0544b5f0eb0e147

Download Submit
\Program Files (x86)\Undertale\unins000.exe
Filesize
2.6MB

MD5
0cd1ac870ce8fa3ad7a43e49ed6ef45c

SHA1
e61d15d087dfc6f6610896db03f3645345134091

SHA256
94209d7ff2428207aa86bfa1cc88b8b1cbbad47d50e6a70277219e27db34ee71

SHA512
9e478818195ffeca95560b24e6a1eace28021bc78ac5dd4033b02760791a6950907809adf492d93d2a7d48e3d845fd30a9cd45ffb5777bbb9ed21a93ddfa8fa4

Download Submit
\Users\Admin\AppData\Local\Temp\is-D4BRT.tmp\Setup.tmp
Filesize
2.5MB

MD5
d9bc11c23aa360311d6b237b23b0c4fd

SHA1
2f6bca0a9d09a1928f139a8a2e0cc872f4284fe7

SHA256
88e4053e376c6597edc6533584b2f2fa3905237fe5db61867e8ee71c3a9e9f5d

SHA512
732b217963e415fb272556731cf8503df431dbc450f6caf59b7c47804c650baebd33735d9fee18537bac37d639f4491a168351fa4b431457f62bae0e219de6fa

Download Submit
memory/608-573-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/608-65-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/608-54-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/1096-67-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1096-548-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1096-71-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1096-208-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1096-572-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1096-66-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1096-539-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1096-61-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1096-544-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/1096-569-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1096-558-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1096-556-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/1096-555-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1096-69-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/1124-586-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1124-585-0x0000000074400000-0x00000000744B1000-memory.dmp

Filesize
708KB

Download
memory/1124-594-0x0000000074400000-0x00000000744B1000-memory.dmp

Filesize
708KB

Download
memory/1744-602-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1744-601-0x00000000743E0000-0x0000000074491000-memory.dmp

Filesize
708KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads