Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2023 18:58
Static task
static1
Behavioral task
behavioral1
Sample
Game Booster v3.4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Game Booster v3.4.exe
Resource
win10v2004-20230220-en
General
-
Target
Game Booster v3.4.exe
-
Size
4.2MB
-
MD5
ab1d5473e2be34629aed5f33969cdcf6
-
SHA1
b39d2a3aa0ffcd4ea8b8b15d4cb790133e71f48e
-
SHA256
5e01060bd60c83bf2fa00c2f25e86fda090da20bde322a25620a47ad3e4d0328
-
SHA512
66cfb2923146e66deef6bf6ff8121cd2522ec9c56fffa59f942fcf81c2ffc9c61581caa92b409680a733767540a7d926f4f6b8ec67805a77a13ca737f44393e3
-
SSDEEP
98304:qh4QVVE8rR5Z+kL5n6XmiH4dfcdDh6DClPyB/cLOH/fDbB0:qmQ7EUZ+R4df9ClOc6HDbB0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Game Booster v3.4.tmppid process 532 Game Booster v3.4.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Game Booster v3.4.exedescription pid process target process PID 4828 wrote to memory of 532 4828 Game Booster v3.4.exe Game Booster v3.4.tmp PID 4828 wrote to memory of 532 4828 Game Booster v3.4.exe Game Booster v3.4.tmp PID 4828 wrote to memory of 532 4828 Game Booster v3.4.exe Game Booster v3.4.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\Game Booster v3.4.exe"C:\Users\Admin\AppData\Local\Temp\Game Booster v3.4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-K246Q.tmp\Game Booster v3.4.tmp"C:\Users\Admin\AppData\Local\Temp\is-K246Q.tmp\Game Booster v3.4.tmp" /SL5="$A005E,3815455,158720,C:\Users\Admin\AppData\Local\Temp\Game Booster v3.4.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-K246Q.tmp\Game Booster v3.4.tmpFilesize
1.1MB
MD530f2396ad4a22e87f99f5c3c30eb1490
SHA1b7b7880b3891ff30434b057b3bbd41100863f0bf
SHA25609e16e8133b6fbc7a7ae2a24b66b29aba71fa0ed710b377d5a2f484168492f6b
SHA512bcbbb6fb5be6eb8029526617fcaa6713ff3c1865161b052e50ebcc253083b05c2e659981872c1ef04f013ce054fbeae6be657ff847709669f1672d047ab7a7d0
-
C:\Users\Admin\AppData\Local\Temp\is-K246Q.tmp\Game Booster v3.4.tmpFilesize
1.1MB
MD530f2396ad4a22e87f99f5c3c30eb1490
SHA1b7b7880b3891ff30434b057b3bbd41100863f0bf
SHA25609e16e8133b6fbc7a7ae2a24b66b29aba71fa0ed710b377d5a2f484168492f6b
SHA512bcbbb6fb5be6eb8029526617fcaa6713ff3c1865161b052e50ebcc253083b05c2e659981872c1ef04f013ce054fbeae6be657ff847709669f1672d047ab7a7d0
-
memory/532-143-0x00000000023C0000-0x00000000023C1000-memory.dmpFilesize
4KB
-
memory/532-148-0x0000000000400000-0x000000000052A000-memory.dmpFilesize
1.2MB
-
memory/532-149-0x00000000023C0000-0x00000000023C1000-memory.dmpFilesize
4KB
-
memory/4828-133-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4828-147-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB