Analysis
-
max time kernel
121s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 00:50
Behavioral task
behavioral1
Sample
SPYGAME.exe
Resource
win7-20230831-en
General
-
Target
SPYGAME.exe
-
Size
274KB
-
MD5
e94364b4239eb39286dd3b07a9ea469c
-
SHA1
95a3fc71b5a4f63e1ce10c163af55b56f168a6f8
-
SHA256
c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f
-
SHA512
bb924f1c1f8b851c70d5639abed43ed047452bac62580d060229e7a054d5f1be269e2888a3dfe511b434ac5a785dcf37216c95cffd8baaa9432cd930670acc13
-
SSDEEP
6144:8f+BLtABPDWlR1ZroWT0Ilb5wqlYeJ6lA1D0wIk:RluK0Ilb5/lYed1DMk
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1101119692103491584/GTMNvMSwfNfgMdtSqTcvjCvj1QDXJYPNxW9vEtgHszOELGeSAQDBrIp9Qf7oWif26BJd
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 freegeoip.app 21 freegeoip.app -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SPYGAME.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 SPYGAME.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier SPYGAME.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SPYGAME.exepid process 900 SPYGAME.exe 900 SPYGAME.exe 900 SPYGAME.exe 900 SPYGAME.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SPYGAME.exedescription pid process Token: SeDebugPrivilege 900 SPYGAME.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
741B
MD5cc24cd77e123bc79e02964e72cbe500b
SHA1abe53023e03d35814b427b144a900d16b255d0aa
SHA256ef6deb3c6b29e8969a18a0437971fe17657f0412b05343cec74fda725af71c95
SHA5124a26a2bcf7d60b0943b0ac1ae39791cfeabb3e93dc2f911daeee3b2da9352692c5abdbeaa9b04b74252b2026908c927bc75883bab85b1c75d0fc47ffd32e0a62
-
Filesize
1KB
MD528c34bedbc07cccd7116f2875be6bbfb
SHA1deeda07cfc20195105d98dcff24dae7d0c4b376f
SHA2569e76b12fe194d9f1eec42866553da38bd55e0f46ae4be63e4685fbbb7cbe5b76
SHA512b48fd241293c615f05093957b699afc292c61b9cbf6d6c7b99ec6a9c51b0eb975111c7f248c2cc5d046451c31592ab3f6fa5e4594dc67365ac8eded9b0362d11
-
Filesize
1KB
MD528c34bedbc07cccd7116f2875be6bbfb
SHA1deeda07cfc20195105d98dcff24dae7d0c4b376f
SHA2569e76b12fe194d9f1eec42866553da38bd55e0f46ae4be63e4685fbbb7cbe5b76
SHA512b48fd241293c615f05093957b699afc292c61b9cbf6d6c7b99ec6a9c51b0eb975111c7f248c2cc5d046451c31592ab3f6fa5e4594dc67365ac8eded9b0362d11