Analysis
-
max time kernel
68s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31/03/2023, 22:53
Static task
static1
Behavioral task
behavioral1
Sample
CS16Launcher.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CS16Launcher.exe
Resource
win10v2004-20230220-en
General
-
Target
CS16Launcher.exe
-
Size
219KB
-
MD5
002569d719a892cefdee47b40fb9de9d
-
SHA1
c87baaf1db6f143eafceafb0e10be366a729cff7
-
SHA256
a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746
-
SHA512
00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321
-
SSDEEP
3072:IBYyRU+jcz36agJ2uSpbYRMGN39N07SMPGEJegpihsYtbssOmxD8X9r+fJb6u:IBYvpL6agJ2uMYrNUhJ5E5wW+u
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 3820 hl.exe -
Loads dropped DLL 14 IoCs
pid Process 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe 3820 hl.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 hl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3820 hl.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4680 wrote to memory of 3820 4680 CS16Launcher.exe 84 PID 4680 wrote to memory of 3820 4680 CS16Launcher.exe 84 PID 4680 wrote to memory of 3820 4680 CS16Launcher.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe"C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\hl.exe-steam -game cstrike -noforcemparms -noforcemaccel2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:3820
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD518d55998df6a48193499f859f8bfebd9
SHA11ee59996d6ca8eec43caa7488bcec58c7d4ba5f3
SHA256dc9bfd575a29abbe1d542ce41143f388cd56b2280f25af64c1699b43a04c1125
SHA512b3818e7fea8d2042466774ecd9c8f2bee6444ecfb0f7f56e73e9c9854c5360969de39501e5439bc50dc894aafe5113ea1001d67280e267b024c6ccfc567261c0
-
Filesize
343KB
MD5f520185e02e8a5d85860669176bc4adc
SHA1cea8e9ff14994c89ad86cf891c89fea42a39250a
SHA256fe62f1eb6ba407df77619d16927abbefad3c726014f6bd1f8c37a7c3d6b781cc
SHA512b434e77a17cdac0109b698d0fccdd25dcdb15090a9fd0427504cc7f616673fa6c7307f07fb22cc2fc1e915887c0f9dc025aa8d38f51503f91df6a9ccee5ebe58
-
Filesize
322KB
MD594d9e620da6bd5fe5a4d20aebb15ec6d
SHA13c63d12fd2fda36048461c3a74ef228bb58da61a
SHA25688f7c7fe458ec238599dc57063a69b6417902f1e3591c6239af7c400954f764e
SHA512d1fe188954b45d2db40dcb06b44fb60dfe09fd0e0118ddebb27cb294202c2f59b49009e99d28e200078b22061d48d5b3de6251f255426087337c9fc462a74af7
-
Filesize
356B
MD549b89267ce7c9daee488b41c7ecbae66
SHA18686b5c577bd192e68a5a7bcb5b08c8395d27812
SHA2565b1b2dd68c2ff1fc6cda3f415cfa7087884ca075c371574aa19c1e4474c4d540
SHA5129790a5b972e94f1809f56c73c27d622a3829a182c7710cbbc4c5f9039337d2f498cdadbfe1930b2b20ce450234638e30eef5873a6e10411555c3ce4181a60d47
-
Filesize
120KB
MD518d55998df6a48193499f859f8bfebd9
SHA11ee59996d6ca8eec43caa7488bcec58c7d4ba5f3
SHA256dc9bfd575a29abbe1d542ce41143f388cd56b2280f25af64c1699b43a04c1125
SHA512b3818e7fea8d2042466774ecd9c8f2bee6444ecfb0f7f56e73e9c9854c5360969de39501e5439bc50dc894aafe5113ea1001d67280e267b024c6ccfc567261c0
-
Filesize
40KB
MD5e1cd35bbc28f73b7481e8835ee0f0b13
SHA1ef40d489c61b178b54f8116548662ee876e0133f
SHA2566ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf
SHA512baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3
-
Filesize
40KB
MD5e1cd35bbc28f73b7481e8835ee0f0b13
SHA1ef40d489c61b178b54f8116548662ee876e0133f
SHA2566ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf
SHA512baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3
-
Filesize
84KB
MD52098ccf443433129b556c2849fe99e26
SHA1074ddbaff48c88b3b5c8f881c35d2be2bb19a249
SHA2564a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af
SHA512fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10
-
Filesize
84KB
MD52098ccf443433129b556c2849fe99e26
SHA1074ddbaff48c88b3b5c8f881c35d2be2bb19a249
SHA2564a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af
SHA512fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10
-
Filesize
1.8MB
MD5a0bc2e53bb55121719af9386ac2ff588
SHA11642aa1bfd63585fb324b8d23806efead856a3c9
SHA2567802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2
SHA512e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92
-
Filesize
1.8MB
MD5a0bc2e53bb55121719af9386ac2ff588
SHA11642aa1bfd63585fb324b8d23806efead856a3c9
SHA2567802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2
SHA512e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92
-
Filesize
1.8MB
MD5a0bc2e53bb55121719af9386ac2ff588
SHA11642aa1bfd63585fb324b8d23806efead856a3c9
SHA2567802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2
SHA512e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92
-
Filesize
69KB
MD53531565d73be13ffdeabc638d0d32ece
SHA159e17ec1365012e143b559a5e33ea1792f5264e0
SHA256ad16e56157ceae1169edb1bfa6c902ce85d3f5e23815403d27ccff32efb1a4f2
SHA5125dc99ef4a12f0feb05f78b911fed456cb81470caf011ecdc5b75485b29e3b4025ff9ae6a51870a9752cbd66f13971b06dd74e6c803ede7c5a4dc0371a2d18235
-
Filesize
69KB
MD53531565d73be13ffdeabc638d0d32ece
SHA159e17ec1365012e143b559a5e33ea1792f5264e0
SHA256ad16e56157ceae1169edb1bfa6c902ce85d3f5e23815403d27ccff32efb1a4f2
SHA5125dc99ef4a12f0feb05f78b911fed456cb81470caf011ecdc5b75485b29e3b4025ff9ae6a51870a9752cbd66f13971b06dd74e6c803ede7c5a4dc0371a2d18235
-
Filesize
343KB
MD5f520185e02e8a5d85860669176bc4adc
SHA1cea8e9ff14994c89ad86cf891c89fea42a39250a
SHA256fe62f1eb6ba407df77619d16927abbefad3c726014f6bd1f8c37a7c3d6b781cc
SHA512b434e77a17cdac0109b698d0fccdd25dcdb15090a9fd0427504cc7f616673fa6c7307f07fb22cc2fc1e915887c0f9dc025aa8d38f51503f91df6a9ccee5ebe58
-
Filesize
257B
MD579e8cbef4f9bcae4515d77059f2a5cd4
SHA129f708d3dd29e1a47837b75c4bd40d95661d563e
SHA256127c6947762873f0056b613de689c6788d64d311cb8d6c48076ca0c9986c173d
SHA512849d7dcea9a2f3adc7204903530c9cc5d254b9e32135dfb0afa070a845f51daccb45f1ff6d145b942e918c51caa1b091ee331b0f2f10fb26fc6b9b888032551b
-
Filesize
322KB
MD594d9e620da6bd5fe5a4d20aebb15ec6d
SHA13c63d12fd2fda36048461c3a74ef228bb58da61a
SHA25688f7c7fe458ec238599dc57063a69b6417902f1e3591c6239af7c400954f764e
SHA512d1fe188954b45d2db40dcb06b44fb60dfe09fd0e0118ddebb27cb294202c2f59b49009e99d28e200078b22061d48d5b3de6251f255426087337c9fc462a74af7
-
Filesize
65KB
MD5fa11b8cf4197e8de4a9e04f97bc1b159
SHA1aeba89ce6faa209587a7a91c6f5f68fb6a0ddf00
SHA256a903b462678281ec5a796fab528f7258b18455dc5e42b87389ba96d2359e4777
SHA5120df1faa6e3480b1a64451d4eac8b9c17c0bbe52138314ffec6c1d968fb4c06570c24c4ca532f7f4261aa295fa8e7dd15039c62318eb3cb562370bc14e61bc32c
-
Filesize
65KB
MD5fa11b8cf4197e8de4a9e04f97bc1b159
SHA1aeba89ce6faa209587a7a91c6f5f68fb6a0ddf00
SHA256a903b462678281ec5a796fab528f7258b18455dc5e42b87389ba96d2359e4777
SHA5120df1faa6e3480b1a64451d4eac8b9c17c0bbe52138314ffec6c1d968fb4c06570c24c4ca532f7f4261aa295fa8e7dd15039c62318eb3cb562370bc14e61bc32c
-
Filesize
65KB
MD5fa11b8cf4197e8de4a9e04f97bc1b159
SHA1aeba89ce6faa209587a7a91c6f5f68fb6a0ddf00
SHA256a903b462678281ec5a796fab528f7258b18455dc5e42b87389ba96d2359e4777
SHA5120df1faa6e3480b1a64451d4eac8b9c17c0bbe52138314ffec6c1d968fb4c06570c24c4ca532f7f4261aa295fa8e7dd15039c62318eb3cb562370bc14e61bc32c
-
Filesize
68KB
MD56baefb250616105b06438d6742d1ebde
SHA1bd5b8f0113ab76dd8e35d6c446ab0286450f5666
SHA25602fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753
SHA5124389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45
-
Filesize
68KB
MD56baefb250616105b06438d6742d1ebde
SHA1bd5b8f0113ab76dd8e35d6c446ab0286450f5666
SHA25602fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753
SHA5124389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45
-
Filesize
68KB
MD56baefb250616105b06438d6742d1ebde
SHA1bd5b8f0113ab76dd8e35d6c446ab0286450f5666
SHA25602fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753
SHA5124389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45
-
Filesize
344KB
MD5d44ee82601ae62ede3e224269a0bbf53
SHA12d00b1d5e052584c6c86ec08795d56d2181a91ee
SHA2560d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998
SHA51200dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398
-
Filesize
344KB
MD5d44ee82601ae62ede3e224269a0bbf53
SHA12d00b1d5e052584c6c86ec08795d56d2181a91ee
SHA2560d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998
SHA51200dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398
-
Filesize
344KB
MD5d44ee82601ae62ede3e224269a0bbf53
SHA12d00b1d5e052584c6c86ec08795d56d2181a91ee
SHA2560d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998
SHA51200dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398