Analysis
-
max time kernel
141s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-03-2023 19:07
Static task
static1
Behavioral task
behavioral1
Sample
Game Booster.ByINFORMACIONLIBRE.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Game Booster.ByINFORMACIONLIBRE.exe
Resource
win10v2004-20230220-en
General
-
Target
Game Booster.ByINFORMACIONLIBRE.exe
-
Size
4.2MB
-
MD5
ab1d5473e2be34629aed5f33969cdcf6
-
SHA1
b39d2a3aa0ffcd4ea8b8b15d4cb790133e71f48e
-
SHA256
5e01060bd60c83bf2fa00c2f25e86fda090da20bde322a25620a47ad3e4d0328
-
SHA512
66cfb2923146e66deef6bf6ff8121cd2522ec9c56fffa59f942fcf81c2ffc9c61581caa92b409680a733767540a7d926f4f6b8ec67805a77a13ca737f44393e3
-
SSDEEP
98304:qh4QVVE8rR5Z+kL5n6XmiH4dfcdDh6DClPyB/cLOH/fDbB0:qmQ7EUZ+R4df9ClOc6HDbB0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Game Booster.ByINFORMACIONLIBRE.tmppid process 2016 Game Booster.ByINFORMACIONLIBRE.tmp -
Loads dropped DLL 3 IoCs
Processes:
Game Booster.ByINFORMACIONLIBRE.exeGame Booster.ByINFORMACIONLIBRE.tmppid process 1196 Game Booster.ByINFORMACIONLIBRE.exe 2016 Game Booster.ByINFORMACIONLIBRE.tmp 2016 Game Booster.ByINFORMACIONLIBRE.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Game Booster.ByINFORMACIONLIBRE.tmppid process 2016 Game Booster.ByINFORMACIONLIBRE.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Game Booster.ByINFORMACIONLIBRE.exedescription pid process target process PID 1196 wrote to memory of 2016 1196 Game Booster.ByINFORMACIONLIBRE.exe Game Booster.ByINFORMACIONLIBRE.tmp PID 1196 wrote to memory of 2016 1196 Game Booster.ByINFORMACIONLIBRE.exe Game Booster.ByINFORMACIONLIBRE.tmp PID 1196 wrote to memory of 2016 1196 Game Booster.ByINFORMACIONLIBRE.exe Game Booster.ByINFORMACIONLIBRE.tmp PID 1196 wrote to memory of 2016 1196 Game Booster.ByINFORMACIONLIBRE.exe Game Booster.ByINFORMACIONLIBRE.tmp PID 1196 wrote to memory of 2016 1196 Game Booster.ByINFORMACIONLIBRE.exe Game Booster.ByINFORMACIONLIBRE.tmp PID 1196 wrote to memory of 2016 1196 Game Booster.ByINFORMACIONLIBRE.exe Game Booster.ByINFORMACIONLIBRE.tmp PID 1196 wrote to memory of 2016 1196 Game Booster.ByINFORMACIONLIBRE.exe Game Booster.ByINFORMACIONLIBRE.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\Game Booster.ByINFORMACIONLIBRE.exe"C:\Users\Admin\AppData\Local\Temp\Game Booster.ByINFORMACIONLIBRE.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-86K6N.tmp\Game Booster.ByINFORMACIONLIBRE.tmp"C:\Users\Admin\AppData\Local\Temp\is-86K6N.tmp\Game Booster.ByINFORMACIONLIBRE.tmp" /SL5="$90122,3815455,158720,C:\Users\Admin\AppData\Local\Temp\Game Booster.ByINFORMACIONLIBRE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-86K6N.tmp\Game Booster.ByINFORMACIONLIBRE.tmpFilesize
1.1MB
MD530f2396ad4a22e87f99f5c3c30eb1490
SHA1b7b7880b3891ff30434b057b3bbd41100863f0bf
SHA25609e16e8133b6fbc7a7ae2a24b66b29aba71fa0ed710b377d5a2f484168492f6b
SHA512bcbbb6fb5be6eb8029526617fcaa6713ff3c1865161b052e50ebcc253083b05c2e659981872c1ef04f013ce054fbeae6be657ff847709669f1672d047ab7a7d0
-
\Users\Admin\AppData\Local\Temp\is-86K6N.tmp\Game Booster.ByINFORMACIONLIBRE.tmpFilesize
1.1MB
MD530f2396ad4a22e87f99f5c3c30eb1490
SHA1b7b7880b3891ff30434b057b3bbd41100863f0bf
SHA25609e16e8133b6fbc7a7ae2a24b66b29aba71fa0ed710b377d5a2f484168492f6b
SHA512bcbbb6fb5be6eb8029526617fcaa6713ff3c1865161b052e50ebcc253083b05c2e659981872c1ef04f013ce054fbeae6be657ff847709669f1672d047ab7a7d0
-
\Users\Admin\AppData\Local\Temp\is-OKHNO.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-OKHNO.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
memory/1196-54-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1196-71-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2016-67-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2016-72-0x0000000000400000-0x000000000052A000-memory.dmpFilesize
1.2MB
-
memory/2016-73-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB