Analysis

  • max time kernel
    1772s
  • max time network
    1168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    13/10/2023, 01:58

General

  • Target

    MythicalLauncher.exe

  • Size

    11.4MB

  • MD5

    b33a49e80dbccc8499dfabfa247b289f

  • SHA1

    f7077e74ea42448907d7a43506009c5538c29bcb

  • SHA256

    77a9093ff3712bac83a45a20a6989539cddae0c2b04d02d135fd3cf503b8814c

  • SHA512

    4c1dcd0597b76eadd26f0f73d1adf0183fe69a3e6906e1f4b070b7898c905e64560355db8667be0c1b2c64c7e7359d372c177da3e050bd0d16383d9e749bd507

  • SSDEEP

    196608:Kbal3uBNNkFOS1ayTYNkFOS1ayTeRJ/tVrMt4qerc+ICwWPX3tnMfY4h2kSIrW:Fl3ytTyitTyyDEW3rc7Cwitch2kSe

Score
7/10

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MythicalLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\MythicalLauncher.exe"
    1⤵
      PID:3200
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 1388
        2⤵
        • Program crash
        PID:3784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 1388
        2⤵
        • Program crash
        PID:3612
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3200 -ip 3200
      1⤵
        PID:2668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3200 -ip 3200
        1⤵
          PID:4236

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3200-0-0x0000000074A30000-0x00000000751E0000-memory.dmp

          Filesize

          7.7MB

        • memory/3200-1-0x0000000000CD0000-0x0000000001830000-memory.dmp

          Filesize

          11.4MB

        • memory/3200-2-0x00000000066E0000-0x0000000006C84000-memory.dmp

          Filesize

          5.6MB

        • memory/3200-3-0x0000000006130000-0x00000000061C2000-memory.dmp

          Filesize

          584KB

        • memory/3200-4-0x0000000006120000-0x0000000006130000-memory.dmp

          Filesize

          64KB

        • memory/3200-5-0x00000000060C0000-0x00000000060CA000-memory.dmp

          Filesize

          40KB

        • memory/3200-6-0x0000000006480000-0x00000000065F6000-memory.dmp

          Filesize

          1.5MB

        • memory/3200-7-0x0000000006600000-0x0000000006632000-memory.dmp

          Filesize

          200KB

        • memory/3200-8-0x0000000006630000-0x0000000006644000-memory.dmp

          Filesize

          80KB

        • memory/3200-9-0x0000000006650000-0x00000000066BA000-memory.dmp

          Filesize

          424KB

        • memory/3200-10-0x0000000006D30000-0x0000000006DCC000-memory.dmp

          Filesize

          624KB

        • memory/3200-11-0x0000000007220000-0x0000000007322000-memory.dmp

          Filesize

          1.0MB

        • memory/3200-12-0x0000000007330000-0x000000000747A000-memory.dmp

          Filesize

          1.3MB

        • memory/3200-13-0x0000000007F60000-0x0000000008076000-memory.dmp

          Filesize

          1.1MB

        • memory/3200-14-0x0000000007610000-0x0000000007640000-memory.dmp

          Filesize

          192KB

        • memory/3200-15-0x0000000074A30000-0x00000000751E0000-memory.dmp

          Filesize

          7.7MB

        • memory/3200-16-0x0000000006120000-0x0000000006130000-memory.dmp

          Filesize

          64KB

        • memory/3200-17-0x0000000074A30000-0x00000000751E0000-memory.dmp

          Filesize

          7.7MB