Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-06-2023 18:14

General

  • Target

    Metal slug 6/Metal slug 6.exe

  • Size

    69.9MB

  • MD5

    1a4313bf87054ee98f5f5a269494cb81

  • SHA1

    bde99f0873ff1bed239e63960c8b53b2886daf60

  • SHA256

    f8e3363c69d2e1cef24b02b3e97be58188644ea5ca8e0f9e37c20ecbfabdb3d0

  • SHA512

    fcca4b5f5f991e88a19b28f54f4ac925bc1072683023ecb95c3da071c384b1cdc61cb37a0d28b4293905b482e2b91beb21ce7003d3a316ac01cc3fd64e18fff8

  • SSDEEP

    1572864:jeu9JTEVNfWocRA/5nrXXwnlVvQvHqt8OowJ3jYTI5zAU+doV6wiDrw:jeu9JkNH2AlMlVv2C8OpqE+dc6JDM

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Metal slug 6\Metal slug 6.exe
    "C:\Users\Admin\AppData\Local\Temp\Metal slug 6\Metal slug 6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Users\Admin\AppData\Local\Temp\is-DA9LV.tmp\Metal slug 6.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DA9LV.tmp\Metal slug 6.tmp" /SL5="$80066,72909502,54272,C:\Users\Admin\AppData\Local\Temp\Metal slug 6\Metal slug 6.exe"
      2⤵
      • Executes dropped EXE
      PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-DA9LV.tmp\Metal slug 6.tmp

    Filesize

    688KB

    MD5

    c765336f0dcf4efdcc2101eed67cd30c

    SHA1

    fa0279f59738c5aa3b6b20106e109ccd77f895a7

    SHA256

    c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

    SHA512

    06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

  • C:\Users\Admin\AppData\Local\Temp\is-DA9LV.tmp\Metal slug 6.tmp

    Filesize

    688KB

    MD5

    c765336f0dcf4efdcc2101eed67cd30c

    SHA1

    fa0279f59738c5aa3b6b20106e109ccd77f895a7

    SHA256

    c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

    SHA512

    06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

  • memory/4692-133-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4692-147-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/5080-139-0x0000000002330000-0x0000000002331000-memory.dmp

    Filesize

    4KB

  • memory/5080-148-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/5080-149-0x0000000002330000-0x0000000002331000-memory.dmp

    Filesize

    4KB