39f01d34065b63c350a3ffe049e03e41c7365b8ca3b603f7e632bec90c3f8c60

Analysis

max time kernel
162s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GameLogin.exe
Size

2.6MB
MD5

a4b1782cb5b0ca57eaf61f155325cce2
SHA1

fd51544776495edc72a3ab2fca4c12651cce9492
SHA256

26adc592bde17f5a04f6c249843e2ea5f3aa084f40f65e8492f2fb200ee2b093
SHA512

dfe22e9b59065f18d5874032d9a31212efc6f38b46ecea3703d402569e3e8bdc0832bfc80c3a3f1a0e2625e8a3c710b829e1136902ae47f7021df8bd879be499
SSDEEP

49152:7hOUzC1ADih/xH3Pz6rOVa2HNO7yslNivNQoG3Fr8J9+tp9wo2:7hdzCuij3qITHQmgivNUuJap9g

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2720	GameLogin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3624	2720	WerFault.exe	87

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GameLogin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GameLogin.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	GameLogin.exe
2720	GameLogin.exe

C:\Users\Admin\AppData\Local\Temp\GameLogin.exe
"C:\Users\Admin\AppData\Local\Temp\GameLogin.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 220
  2⤵
  - Program crash
  PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2720 -ip 2720
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2720-0-0x0000000000400000-0x0000000000A1F01C-memory.dmp

Filesize
6.1MB

Download
memory/2720-1-0x0000000000400000-0x0000000000A1F01C-memory.dmp

Filesize
6.1MB

Download
memory/2720-2-0x0000000000400000-0x0000000000A1F01C-memory.dmp

Filesize
6.1MB

Download
memory/2720-5-0x0000000000400000-0x0000000000A1F01C-memory.dmp

Filesize
6.1MB

Download
memory/2720-8-0x0000000000400000-0x0000000000A1F01C-memory.dmp

Filesize
6.1MB

Download
memory/2720-9-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/2720-10-0x0000000000400000-0x0000000000A1F01C-memory.dmp

Filesize
6.1MB

Download
memory/2720-12-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download