a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746

Analysis

max time kernel
68s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CS16Launcher.exe
Size

219KB
MD5

002569d719a892cefdee47b40fb9de9d
SHA1

c87baaf1db6f143eafceafb0e10be366a729cff7
SHA256

a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746
SHA512

00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321
SSDEEP

3072:IBYyRU+jcz36agJ2uSpbYRMGN39N07SMPGEJegpihsYtbssOmxD8X9r+fJb6u:IBYvpL6agJ2uMYrNUhJ5E5wW+u

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

hl.exe

pid process

3820 hl.exe

Loads dropped DLL 14 IoCs

Processes:

hl.exe

pid	process
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe
3820	hl.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

hl.exe

description ioc process

File opened for modification \??\PhysicalDrive0 hl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

hl.exe

pid process

3820 hl.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	hl.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

CS16Launcher.exe

description	pid	process	target process
PID 4680 wrote to memory of 3820	4680	CS16Launcher.exe	hl.exe
PID 4680 wrote to memory of 3820	4680	CS16Launcher.exe	hl.exe
PID 4680 wrote to memory of 3820	4680	CS16Launcher.exe	hl.exe

C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Users\Admin\AppData\Local\Temp\hl.exe
-steam -game cstrike -noforcemparms -noforcemaccel
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:3820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FileSystem_Steam.dll
Filesize
120KB

MD5
18d55998df6a48193499f859f8bfebd9

SHA1
1ee59996d6ca8eec43caa7488bcec58c7d4ba5f3

SHA256
dc9bfd575a29abbe1d542ce41143f388cd56b2280f25af64c1699b43a04c1125

SHA512
b3818e7fea8d2042466774ecd9c8f2bee6444ecfb0f7f56e73e9c9854c5360969de39501e5439bc50dc894aafe5113ea1001d67280e267b024c6ccfc567261c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mss32.dll
Filesize
343KB

MD5
f520185e02e8a5d85860669176bc4adc

SHA1
cea8e9ff14994c89ad86cf891c89fea42a39250a

SHA256
fe62f1eb6ba407df77619d16927abbefad3c726014f6bd1f8c37a7c3d6b781cc

SHA512
b434e77a17cdac0109b698d0fccdd25dcdb15090a9fd0427504cc7f616673fa6c7307f07fb22cc2fc1e915887c0f9dc025aa8d38f51503f91df6a9ccee5ebe58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Steam.dll
Filesize
322KB

MD5
94d9e620da6bd5fe5a4d20aebb15ec6d

SHA1
3c63d12fd2fda36048461c3a74ef228bb58da61a

SHA256
88f7c7fe458ec238599dc57063a69b6417902f1e3591c6239af7c400954f764e

SHA512
d1fe188954b45d2db40dcb06b44fb60dfe09fd0e0118ddebb27cb294202c2f59b49009e99d28e200078b22061d48d5b3de6251f255426087337c9fc462a74af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cstrike\valve.rc
Filesize
356B

MD5
49b89267ce7c9daee488b41c7ecbae66

SHA1
8686b5c577bd192e68a5a7bcb5b08c8395d27812

SHA256
5b1b2dd68c2ff1fc6cda3f415cfa7087884ca075c371574aa19c1e4474c4d540

SHA512
9790a5b972e94f1809f56c73c27d622a3829a182c7710cbbc4c5f9039337d2f498cdadbfe1930b2b20ce450234638e30eef5873a6e10411555c3ce4181a60d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\filesystem_steam.dll
Filesize
120KB

MD5
18d55998df6a48193499f859f8bfebd9

SHA1
1ee59996d6ca8eec43caa7488bcec58c7d4ba5f3

SHA256
dc9bfd575a29abbe1d542ce41143f388cd56b2280f25af64c1699b43a04c1125

SHA512
b3818e7fea8d2042466774ecd9c8f2bee6444ecfb0f7f56e73e9c9854c5360969de39501e5439bc50dc894aafe5113ea1001d67280e267b024c6ccfc567261c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\h0xnW2sQ.dat
Filesize
40KB

MD5
e1cd35bbc28f73b7481e8835ee0f0b13

SHA1
ef40d489c61b178b54f8116548662ee876e0133f

SHA256
6ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf

SHA512
baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\h0xnW2sQ.dat
Filesize
40KB

MD5
e1cd35bbc28f73b7481e8835ee0f0b13

SHA1
ef40d489c61b178b54f8116548662ee876e0133f

SHA256
6ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf

SHA512
baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hl.exe
Filesize
84KB

MD5
2098ccf443433129b556c2849fe99e26

SHA1
074ddbaff48c88b3b5c8f881c35d2be2bb19a249

SHA256
4a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af

SHA512
fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\hl.exe
Filesize
84KB

MD5
2098ccf443433129b556c2849fe99e26

SHA1
074ddbaff48c88b3b5c8f881c35d2be2bb19a249

SHA256
4a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af

SHA512
fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\hw.dll
Filesize
1.8MB

MD5
a0bc2e53bb55121719af9386ac2ff588

SHA1
1642aa1bfd63585fb324b8d23806efead856a3c9

SHA256
7802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2

SHA512
e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\hw.dll
Filesize
1.8MB

MD5
a0bc2e53bb55121719af9386ac2ff588

SHA1
1642aa1bfd63585fb324b8d23806efead856a3c9

SHA256
7802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2

SHA512
e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\hw.dll
Filesize
1.8MB

MD5
a0bc2e53bb55121719af9386ac2ff588

SHA1
1642aa1bfd63585fb324b8d23806efead856a3c9

SHA256
7802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2

SHA512
e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\hwpatcher.dll
Filesize
69KB

MD5
3531565d73be13ffdeabc638d0d32ece

SHA1
59e17ec1365012e143b559a5e33ea1792f5264e0

SHA256
ad16e56157ceae1169edb1bfa6c902ce85d3f5e23815403d27ccff32efb1a4f2

SHA512
5dc99ef4a12f0feb05f78b911fed456cb81470caf011ecdc5b75485b29e3b4025ff9ae6a51870a9752cbd66f13971b06dd74e6c803ede7c5a4dc0371a2d18235

Download Submit
C:\Users\Admin\AppData\Local\Temp\hwpatcher.dll
Filesize
69KB

MD5
3531565d73be13ffdeabc638d0d32ece

SHA1
59e17ec1365012e143b559a5e33ea1792f5264e0

SHA256
ad16e56157ceae1169edb1bfa6c902ce85d3f5e23815403d27ccff32efb1a4f2

SHA512
5dc99ef4a12f0feb05f78b911fed456cb81470caf011ecdc5b75485b29e3b4025ff9ae6a51870a9752cbd66f13971b06dd74e6c803ede7c5a4dc0371a2d18235

Download Submit
C:\Users\Admin\AppData\Local\Temp\mss32.dll
Filesize
343KB

MD5
f520185e02e8a5d85860669176bc4adc

SHA1
cea8e9ff14994c89ad86cf891c89fea42a39250a

SHA256
fe62f1eb6ba407df77619d16927abbefad3c726014f6bd1f8c37a7c3d6b781cc

SHA512
b434e77a17cdac0109b698d0fccdd25dcdb15090a9fd0427504cc7f616673fa6c7307f07fb22cc2fc1e915887c0f9dc025aa8d38f51503f91df6a9ccee5ebe58

Download Submit
C:\Users\Admin\AppData\Local\Temp\platform\config\MasterServers.vdf
Filesize
257B

MD5
79e8cbef4f9bcae4515d77059f2a5cd4

SHA1
29f708d3dd29e1a47837b75c4bd40d95661d563e

SHA256
127c6947762873f0056b613de689c6788d64d311cb8d6c48076ca0c9986c173d

SHA512
849d7dcea9a2f3adc7204903530c9cc5d254b9e32135dfb0afa070a845f51daccb45f1ff6d145b942e918c51caa1b091ee331b0f2f10fb26fc6b9b888032551b

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam.dll
Filesize
322KB

MD5
94d9e620da6bd5fe5a4d20aebb15ec6d

SHA1
3c63d12fd2fda36048461c3a74ef228bb58da61a

SHA256
88f7c7fe458ec238599dc57063a69b6417902f1e3591c6239af7c400954f764e

SHA512
d1fe188954b45d2db40dcb06b44fb60dfe09fd0e0118ddebb27cb294202c2f59b49009e99d28e200078b22061d48d5b3de6251f255426087337c9fc462a74af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam_api.dll
Filesize
65KB

MD5
fa11b8cf4197e8de4a9e04f97bc1b159

SHA1
aeba89ce6faa209587a7a91c6f5f68fb6a0ddf00

SHA256
a903b462678281ec5a796fab528f7258b18455dc5e42b87389ba96d2359e4777

SHA512
0df1faa6e3480b1a64451d4eac8b9c17c0bbe52138314ffec6c1d968fb4c06570c24c4ca532f7f4261aa295fa8e7dd15039c62318eb3cb562370bc14e61bc32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam_api.dll
Filesize
65KB

MD5
fa11b8cf4197e8de4a9e04f97bc1b159

SHA1
aeba89ce6faa209587a7a91c6f5f68fb6a0ddf00

SHA256
a903b462678281ec5a796fab528f7258b18455dc5e42b87389ba96d2359e4777

SHA512
0df1faa6e3480b1a64451d4eac8b9c17c0bbe52138314ffec6c1d968fb4c06570c24c4ca532f7f4261aa295fa8e7dd15039c62318eb3cb562370bc14e61bc32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam_api.dll
Filesize
65KB

MD5
fa11b8cf4197e8de4a9e04f97bc1b159

SHA1
aeba89ce6faa209587a7a91c6f5f68fb6a0ddf00

SHA256
a903b462678281ec5a796fab528f7258b18455dc5e42b87389ba96d2359e4777

SHA512
0df1faa6e3480b1a64451d4eac8b9c17c0bbe52138314ffec6c1d968fb4c06570c24c4ca532f7f4261aa295fa8e7dd15039c62318eb3cb562370bc14e61bc32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam_api_c.dll
Filesize
68KB

MD5
6baefb250616105b06438d6742d1ebde

SHA1
bd5b8f0113ab76dd8e35d6c446ab0286450f5666

SHA256
02fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753

SHA512
4389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam_api_c.dll
Filesize
68KB

MD5
6baefb250616105b06438d6742d1ebde

SHA1
bd5b8f0113ab76dd8e35d6c446ab0286450f5666

SHA256
02fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753

SHA512
4389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam_api_c.dll
Filesize
68KB

MD5
6baefb250616105b06438d6742d1ebde

SHA1
bd5b8f0113ab76dd8e35d6c446ab0286450f5666

SHA256
02fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753

SHA512
4389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\vgui.dll
Filesize
344KB

MD5
d44ee82601ae62ede3e224269a0bbf53

SHA1
2d00b1d5e052584c6c86ec08795d56d2181a91ee

SHA256
0d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998

SHA512
00dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398

Download Submit
C:\Users\Admin\AppData\Local\Temp\vgui.dll
Filesize
344KB

MD5
d44ee82601ae62ede3e224269a0bbf53

SHA1
2d00b1d5e052584c6c86ec08795d56d2181a91ee

SHA256
0d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998

SHA512
00dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398

Download Submit
C:\Users\Admin\AppData\Local\Temp\vgui.dll
Filesize
344KB

MD5
d44ee82601ae62ede3e224269a0bbf53

SHA1
2d00b1d5e052584c6c86ec08795d56d2181a91ee

SHA256
0d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998

SHA512
00dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398

Download Submit
memory/3820-294-0x0000000000DB0000-0x0000000000DC5000-memory.dmp

Filesize
84KB

Download
memory/3820-279-0x0000000000D30000-0x0000000000D45000-memory.dmp

Filesize
84KB

Download
memory/3820-292-0x0000000000E00000-0x0000000000E58000-memory.dmp

Filesize
352KB

Download
memory/3820-284-0x0000000004930000-0x0000000005B5A000-memory.dmp

Filesize
18.2MB

Download
memory/3820-283-0x0000000004930000-0x0000000005B5A000-memory.dmp

Filesize
18.2MB

Download
memory/3820-270-0x0000000000D20000-0x0000000000D2F000-memory.dmp

Filesize
60KB

Download
memory/3820-300-0x0000000004930000-0x0000000005B5A000-memory.dmp

Filesize
18.2MB

Download