Overview
overview
9Static
static
3ARK Surviv...er.exe
windows7-x64
1ARK Surviv...er.exe
windows10-2004-x64
1ARK Surviv...ch.exe
windows7-x64
1ARK Surviv...ch.exe
windows10-2004-x64
1ARK Surviv...er.bat
windows7-x64
7ARK Surviv...er.bat
windows10-2004-x64
9ARK Surviv...ck.dll
windows7-x64
1ARK Surviv...ck.dll
windows10-2004-x64
1ARK Surviv...64.dll
windows7-x64
1ARK Surviv...64.dll
windows10-2004-x64
1ARK Surviv...64.exe
windows7-x64
1ARK Surviv...64.exe
windows10-2004-x64
1ARK Surviv...64.dll
windows7-x64
5ARK Surviv...64.dll
windows10-2004-x64
5ARK Surviv...le.dll
windows7-x64
1ARK Surviv...le.dll
windows10-2004-x64
1ARK Surviv...a2.dll
windows7-x64
1ARK Surviv...a2.dll
windows10-2004-x64
1ARK Surviv...md.exe
windows7-x64
1ARK Surviv...md.exe
windows10-2004-x64
9Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2023, 02:31
Static task
static1
Behavioral task
behavioral1
Sample
ARK Survival Evolved/ARKLauncher.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ARK Survival Evolved/ARKLauncher.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
ARK Survival Evolved/AppID_Patch.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
ARK Survival Evolved/AppID_Patch.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
ARK Survival Evolved/ArkDownloader.bat
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
ARK Survival Evolved/ArkDownloader.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
ARK Survival Evolved/InnoCallback.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
ARK Survival Evolved/InnoCallback.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
ARK Survival Evolved/ShooterGame/Binaries/Win64/LumaGameLauncher_x64.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
ARK Survival Evolved/ShooterGame/Binaries/Win64/LumaGameLauncher_x64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
ARK Survival Evolved/ShooterGame/Binaries/Win64/LumaGameLauncher_x64.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
ARK Survival Evolved/ShooterGame/Binaries/Win64/LumaGameLauncher_x64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
ARK Survival Evolved/ShooterGame/Binaries/Win64/steamclient64.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
ARK Survival Evolved/ShooterGame/Binaries/Win64/steamclient64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
ARK Survival Evolved/Style.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
ARK Survival Evolved/Style.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
ARK Survival Evolved/botva2.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
ARK Survival Evolved/botva2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
ARK Survival Evolved/steamcmd.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
ARK Survival Evolved/steamcmd.exe
Resource
win10v2004-20230220-en
General
-
Target
ARK Survival Evolved/Style.dll
-
Size
2.0MB
-
MD5
16d22d5492bda0e1ab73c78118a5b3fb
-
SHA1
2d01de9c448f50254e5ab6486c1678dbe625b092
-
SHA256
97469efd5dcf4caa0d32d4d96405277d730059102f36f22f3fdb59159570fb91
-
SHA512
ff62ce62509b49dbae39a1a6762f247e68bda6d8cf30015ebfbbb431a5c5122a9325331462f4b2d3df0119f44ff95eee586b2248d880f8e6a2e277f59bbbde1d
-
SSDEEP
49152:qCOIa+f8y5f8Bk3VTaStGYPtjDTUrfuagyE:qD2803oUtAr
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3980 wrote to memory of 3368 3980 rundll32.exe 83 PID 3980 wrote to memory of 3368 3980 rundll32.exe 83 PID 3980 wrote to memory of 3368 3980 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\ARK Survival Evolved\Style.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\ARK Survival Evolved\Style.dll",#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3368
-