Overview

overview

8

Static

static

1

FMod_Launc...US.msi

windows7-x64

7

FMod_Launc...US.msi

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    FMod_Launcher_3.1.5_x64_en-US.msi

  • Size

    10.1MB

  • Sample

    230529-cfjr1shb58

  • MD5

    8b02254a55fb364c33c0b0043deac2bf

  • SHA1

    be0f11c82df28c42b8215298db823dd59b80dffa

  • SHA256

    c5354741773217a71318d667d501b39b15a4765896056460d6db19f45157d926

  • SHA512

    e7de4123ab6d74cb7ba65cf9e2d94ae992c7fda89aed07dc76ca29104c0b994d241ad8732bfd24538211e09d13cef5756749af24845e187274975739b4c69f71

  • SSDEEP

    196608:K1pcw8suKNKmaKh/VAhtmO98fPeBFaYf/Ar0Qk7WkffQIeSD3xCGnnSqoip9:K1pcw8WtPnygP0l/Ar0pzfQz2nSk

Score
8/10
persistence

Malware Config

Targets

    • Target

      FMod_Launcher_3.1.5_x64_en-US.msi

    • Size

      10.1MB

    • MD5

      8b02254a55fb364c33c0b0043deac2bf

    • SHA1

      be0f11c82df28c42b8215298db823dd59b80dffa

    • SHA256

      c5354741773217a71318d667d501b39b15a4765896056460d6db19f45157d926

    • SHA512

      e7de4123ab6d74cb7ba65cf9e2d94ae992c7fda89aed07dc76ca29104c0b994d241ad8732bfd24538211e09d13cef5756749af24845e187274975739b4c69f71

    • SSDEEP

      196608:K1pcw8suKNKmaKh/VAhtmO98fPeBFaYf/Ar0Qk7WkffQIeSD3xCGnnSqoip9:K1pcw8WtPnygP0l/Ar0pzfQz2nSk

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks