Overview

overview

5

Static

static

1

File-BeamN...71.exe

windows7-x64

4

File-BeamN...71.exe

windows10-1703-x64

4

File-BeamN...71.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-09-2023 16:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe

  • Size

    4.0MB

  • MD5

    40e45a1b5d1493e4adbddc41248eeb0d

  • SHA1

    9ca3c821a94bf934a7dfa62c101b673a014b1642

  • SHA256

    dc287b1f38dfd32bdd479048022dba205674c378882867499ae216cbd251f6f5

  • SHA512

    b9fa071713c40a3cec1c679ffba7ae3409cee46730ddb7240c11971cb5435782204bdc9b0c4eb4e2249f15130470368df043fd7a6e5d50d17abf87d386487759

  • SSDEEP

    49152:FmfdOTMpa40Ab7JwSS9EFClzMucUJTYb6lHI5duHS3nZ561dFT/o0PmuYsdcg:qdwka4j0p9cei6sdES3XAdFGuYY1

Score
5/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 1 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
    "C:\Users\Admin\AppData\Local\Temp\File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:380
    • C:\Users\Admin\AppData\Local\Temp\File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
      "C:\Users\Admin\AppData\Local\Temp\File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe" --pt
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4432
      • C:\Program Files (x86)\RigidFEELINGzbaApp\RigidzApp.exe
        "C:\Program Files (x86)\RigidFEELINGzbaApp\RigidzApp.exe"
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Registers COM server for autorun
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\RigidFEELINGzbaApp\RigidzApp.exe
    Filesize

    1.5MB

    MD5

    a6a0f7c173094f8dafef996157751ecf

    SHA1

    c0dcae7c4c80be25661d22400466b4ea074fc580

    SHA256

    b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

    SHA512

    965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

    Download Submit
  • C:\Program Files (x86)\RigidFEELINGzbaApp\RigidzApp.exe
    Filesize

    1.5MB

    MD5

    a6a0f7c173094f8dafef996157751ecf

    SHA1

    c0dcae7c4c80be25661d22400466b4ea074fc580

    SHA256

    b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

    SHA512

    965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

    Download Submit
  • C:\Program Files (x86)\RigidFEELINGzbaApp\RigidzApp.exe
    Filesize

    1.5MB

    MD5

    a6a0f7c173094f8dafef996157751ecf

    SHA1

    c0dcae7c4c80be25661d22400466b4ea074fc580

    SHA256

    b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

    SHA512

    965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

    Download Submit
  • memory/380-0-0x00000000018F0000-0x00000000018F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/380-1-0x0000000000850000-0x0000000000C6E000-memory.dmp
    Filesize

    4.1MB

    Download
  • memory/4432-2-0x00000000006F0000-0x00000000006F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4432-13-0x0000000000850000-0x0000000000C6E000-memory.dmp
    Filesize

    4.1MB

    Download