Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 06:42
Static task
static1
Behavioral task
behavioral1
Sample
ACreedOrigins+20Tr_LNG/ACreedOrigins+20Tr_LNG.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ACreedOrigins+20Tr_LNG/ACreedOrigins+20Tr_LNG.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
ACreedOrigins+20Tr_LNG/Всё для S.T.A.L.K.E.R., моды Stalker, файлы Сталкер - Stalker news.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
ACreedOrigins+20Tr_LNG/Всё для S.T.A.L.K.E.R., моды Stalker, файлы Сталкер - Stalker news.url
Resource
win10v2004-20231215-en
General
-
Target
ACreedOrigins+20Tr_LNG/ACreedOrigins+20Tr_LNG.exe
-
Size
5.9MB
-
MD5
b4ac3c9b8d0c100f22e98fbc5bbfa9d6
-
SHA1
c0db3207981894becc6613731a90680c047119cd
-
SHA256
24efc407fc2f4d6e3a5b8ee84ace5862c0bbc6ea02630d9b6f417de6242f3139
-
SHA512
9318c9b2080141d82ea0629df6db9f9bec87ba3b45e26085dd5b4777fbad231da03fa0397944f7803014532a170c05c98c3ea478a8945279bf5632b0cf9bad80
-
SSDEEP
98304:H/3K0XguJyEiog94IhS1eMXmWkvLoYGQlAkxpP2vrXG6g+nC:HvK0XguJyEiogXS1eMXmzvBGIAkxpuva
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe 2040 ACreedOrigins+20Tr_LNG.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2040 ACreedOrigins+20Tr_LNG.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2040 ACreedOrigins+20Tr_LNG.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2040 ACreedOrigins+20Tr_LNG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ACreedOrigins+20Tr_LNG\ACreedOrigins+20Tr_LNG.exe"C:\Users\Admin\AppData\Local\Temp\ACreedOrigins+20Tr_LNG\ACreedOrigins+20Tr_LNG.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2040
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5c74d260d388f5ac3d95d8c1c3a27c989
SHA15da009086036004a7c670d608d5e1e923aead568
SHA256dc1bebb8ce88d59e4b3130c1ff2c4b7f5df2701c7a71b476b8a6f2ed541db628
SHA5126460db8f73806017d267c0e4e112902956a3bc53853c6a893cff66fe44772305b2c158ef8b58e993806d713aceaddcf2efa7ccf625063678444d3fd20b10546a