Analysis
-
max time kernel
66s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
16-03-2023 21:41
Static task
static1
Behavioral task
behavioral1
Sample
Hotline Miami 3D Text Generator v2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Hotline Miami 3D Text Generator v2.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
data.win
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
data.win
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
options.ini
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
options.ini
Resource
win10v2004-20230221-en
General
-
Target
Hotline Miami 3D Text Generator v2.exe
-
Size
5.9MB
-
MD5
7c017eb90fde9db2dcc728bf952281f4
-
SHA1
409435d515277ffeb164d70d6f1e314cd102517f
-
SHA256
b21e12727d35cb713d18ef78d7562275a59bc55adfebe8f15745d0081c0b5ca4
-
SHA512
de7aa88b7a29387c08c67e7d759aad77f12dd1b25dc617fc8c46e2b9bfb76537c33bb36614999b2c7ee65bc6be103bcfc9f4210356832f60da8d946d2a0636cb
-
SSDEEP
49152:l2XRgESS97T3w8aXiQaVLj5ao6BlyI2d+VRKpVOBCG2d458AfTEcWmg0NaSDl3BB:UasFrcX9Rrj8aPdg0EGUZkrMp4Vj5
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1336 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1336 AUDIODG.EXE Token: 33 1336 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1336 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1200 Hotline Miami 3D Text Generator v2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1868 Hotline Miami 3D Text Generator v2.exe 1868 Hotline Miami 3D Text Generator v2.exe 1200 Hotline Miami 3D Text Generator v2.exe 1200 Hotline Miami 3D Text Generator v2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hotline Miami 3D Text Generator v2.exe"C:\Users\Admin\AppData\Local\Temp\Hotline Miami 3D Text Generator v2.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1868
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5601⤵
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
C:\Users\Admin\AppData\Local\Temp\Hotline Miami 3D Text Generator v2.exe"C:\Users\Admin\AppData\Local\Temp\Hotline Miami 3D Text Generator v2.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1200