Overview
overview
3Static
static
3Monster_Bl...en.rar
windows7-x64
3Monster_Bl...en.rar
windows10-2004-x64
3Monster Bl...gc.dll
windows7-x64
1Monster Bl...gc.dll
windows10-2004-x64
1Monster Bl...tor.js
windows7-x64
1Monster Bl...tor.js
windows10-2004-x64
1Monster Bl...tor.js
windows7-x64
1Monster Bl...tor.js
windows10-2004-x64
1Monster Bl...tor.js
windows7-x64
1Monster Bl...tor.js
windows10-2004-x64
1Monster Bl...et.exe
windows7-x64
1Monster Bl...et.exe
windows10-2004-x64
1Monster Bl...ss.dll
windows7-x64
1Monster Bl...ss.dll
windows10-2004-x64
1Monster Bl...rp.dll
windows7-x64
1Monster Bl...rp.dll
windows10-2004-x64
1Monster Bl...xt.dll
windows7-x64
1Monster Bl...xt.dll
windows10-2004-x64
1Monster Bl...mo.dll
windows7-x64
1Monster Bl...mo.dll
windows10-2004-x64
1Monster Bl...me.dll
windows7-x64
1Monster Bl...me.dll
windows10-2004-x64
1Monster Bl...UI.dll
windows7-x64
1Monster Bl...UI.dll
windows10-2004-x64
1Monster Bl...en.dll
windows7-x64
1Monster Bl...en.dll
windows10-2004-x64
1Monster Bl...me.dll
windows7-x64
1Monster Bl...me.dll
windows10-2004-x64
1Monster Bl...mo.dll
windows7-x64
1Monster Bl...mo.dll
windows10-2004-x64
1Monster Bl...RP.dll
windows7-x64
1Monster Bl...RP.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
282s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 01:32
Static task
static1
Behavioral task
behavioral1
Sample
Monster_Black_Market_V2.0.16.0_w_DLC_w_Uncen.rar
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Monster_Black_Market_V2.0.16.0_w_DLC_w_Uncen.rar
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.js
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.js
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.js
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket.exe
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/Assembly-CSharp-firstpass.dll
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/Assembly-CSharp-firstpass.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/Assembly-CSharp.dll
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/Assembly-CSharp.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/BCrypt.Net-Next.dll
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/BCrypt.Net-Next.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/CFXRDemo.dll
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/CFXRDemo.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral21
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/CFXRRuntime.dll
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/CFXRRuntime.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/Coffee.UnmaskForUGUI.dll
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/Coffee.UnmaskForUGUI.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/DOTween.dll
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/DOTween.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral27
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/KinoBloom.Runtime.dll
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/KinoBloom.Runtime.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral29
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/LeTai.TranslucentImage.Demo.dll
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/LeTai.TranslucentImage.Demo.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral31
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/LeTai.TranslucentImage.UniversalRP.dll
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket_Data/Managed/LeTai.TranslucentImage.UniversalRP.dll
Resource
win10v2004-20230915-en
General
-
Target
Monster Black Market V2.0.16.0 w DLC w Uncen/MonsterBlackMarket.exe
-
Size
638KB
-
MD5
2fba04830ca0d1854911f96d0a11242c
-
SHA1
2ea0bd960b99b8aad05546417e620367fa1a35b7
-
SHA256
b3ab8d098064acdd646d878570381ba180bbd40a785e45a39c0de7c55523db1d
-
SHA512
4f13d107cdfe5c099f318a233d32426ab3f71d13e874d54b9feb7c3462d1916a4e6bc34a1c8cb53f5da933c10245e392b9bc85c0c13834e388bbbc03e6a9bc2c
-
SSDEEP
12288:L4eCuedtIVlCPg20YCF4DggUjFVcgbV2:syGhHyko2
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3672 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3672 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4384 MonsterBlackMarket.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4384 wrote to memory of 2000 4384 MonsterBlackMarket.exe 83 PID 4384 wrote to memory of 2000 4384 MonsterBlackMarket.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Monster Black Market V2.0.16.0 w DLC w Uncen\MonsterBlackMarket.exe"C:\Users\Admin\AppData\Local\Temp\Monster Black Market V2.0.16.0 w DLC w Uncen\MonsterBlackMarket.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\Monster Black Market V2.0.16.0 w DLC w Uncen\UnityCrashHandler64.exe"C:\Users\Admin\AppData\Local\Temp\Monster Black Market V2.0.16.0 w DLC w Uncen\UnityCrashHandler64.exe" --attach 4384 26509083975682⤵PID:2000
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x340 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3672