b9d57e25adc29a7de4ea88bf280cc15e305128ea60101d0533f47d13fd4e662f

Analysis

max time kernel
135s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dealers Life 2 Pirata/DealersLife2.exe
Size

638KB
MD5

4fb6fca79936fa0905f25866b2367a09
SHA1

a4303900aeb1f85b434b339a71e365dcb47207ef
SHA256

7516f4065f79f4b45c79eea438426e28aa4c444dc0e189cdc245efd5df2b8fbf
SHA512

a6c8553e04da25ea26ad4e6baba803ab73ec758d24bea6e279ea91e0685236f03ff54969d1c5064eab38a10be8b5832d81d9f0859c11505364b4ebe4f6ddf687
SSDEEP

12288:9oCCAjH828z88p88tn88v88z8A8wgLeHD8T88r888f55o3nzWREXOw:6seLw6AOw

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\kernelbase.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	DealersLife2.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	DealersLife2.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ntdll.pdb	DealersLife2.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	DealersLife2.exe
File opened for modification	C:\Windows\kernelbase.pdb	DealersLife2.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	DealersLife2.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	DealersLife2.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	DealersLife2.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	DealersLife2.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	DealersLife2.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	DealersLife2.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	DealersLife2.exe
File opened for modification	C:\Windows\kernel32.pdb	DealersLife2.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	DealersLife2.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DealersLife2.exe
Key opened	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DealersLife2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DealersLife2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DealersLife2.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3532	DealersLife2.exe
3532	DealersLife2.exe
856	UnityCrashHandler64.exe
856	UnityCrashHandler64.exe
856	UnityCrashHandler64.exe
856	UnityCrashHandler64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2852	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3532	DealersLife2.exe
3532	DealersLife2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 856	3532	DealersLife2.exe	88
PID 3532 wrote to memory of 856	3532	DealersLife2.exe	88
PID 856 wrote to memory of 4276	856	UnityCrashHandler64.exe	97
PID 856 wrote to memory of 4276	856	UnityCrashHandler64.exe	97

C:\Users\Admin\AppData\Local\Temp\Dealers Life 2 Pirata\DealersLife2.exe
"C:\Users\Admin\AppData\Local\Temp\Dealers Life 2 Pirata\DealersLife2.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Users\Admin\AppData\Local\Temp\Dealers Life 2 Pirata\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\Dealers Life 2 Pirata\UnityCrashHandler64.exe" --attach 3532 2440879673344
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Users\Admin\AppData\Local\Temp\Dealers Life 2 Pirata\UnityCrashHandler64.exe
    "C:\Users\Admin\AppData\Local\Temp\Dealers Life 2 Pirata\UnityCrashHandler64.exe" "3532" "2440879673344"
    3⤵
    PID:4276

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x51c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Abyte Entertainment\DealersLife2\Player.log

Filesize
13KB

MD5
87d48150cf8f09f360c3f1beae4b4ccd

SHA1
b968692b8d370789b9cd657aa3263fc3207a6f29

SHA256
ba36f87a595dea10e7feebb3335920a5d0a1fe207569279f29cd2a831a8b0af1

SHA512
c71938bfa1d32b967acec7f11346a0207ab90be2218a4023e3e5b9aab680a442489fe86c85601d344a062d04a29e19d6c6bb9fa1f29209fa31711eb6f8758c91

Download Submit
memory/3532-0-0x000002384FD90000-0x000002384FDA0000-memory.dmp

Filesize
64KB

Download
memory/3532-1-0x000002384FC70000-0x000002384FC80000-memory.dmp

Filesize
64KB

Download
memory/3532-5-0x00000239B3D60000-0x00000239B3D70000-memory.dmp

Filesize
64KB

Download
memory/3532-6-0x00000239B3D70000-0x00000239B3D80000-memory.dmp

Filesize
64KB

Download
memory/3532-7-0x00000239F5D90000-0x00000239F5DA0000-memory.dmp

Filesize
64KB

Download
memory/3532-8-0x00000239F5DA0000-0x00000239F5DB0000-memory.dmp

Filesize
64KB

Download
memory/3532-9-0x00000239F5DB0000-0x00000239F5DC0000-memory.dmp

Filesize
64KB

Download
memory/3532-10-0x00007FFC08240000-0x00007FFC08250000-memory.dmp

Filesize
64KB

Download
memory/3532-11-0x00000239F5E00000-0x00000239F5E10000-memory.dmp

Filesize
64KB

Download
memory/3532-19-0x00007FFC08240000-0x00007FFC08250000-memory.dmp

Filesize
64KB

Download
memory/3532-21-0x00007FFC08240000-0x00007FFC08250000-memory.dmp

Filesize
64KB

Download
memory/3532-20-0x0000023A5B490000-0x0000023A5B4A0000-memory.dmp

Filesize
64KB

Download
memory/3532-24-0x0000023A5B800000-0x0000023A5B810000-memory.dmp

Filesize
64KB

Download
memory/3532-25-0x000002384FD90000-0x000002384FDA0000-memory.dmp

Filesize
64KB

Download
memory/3532-26-0x000002384FC70000-0x000002384FC80000-memory.dmp

Filesize
64KB

Download
memory/3532-28-0x0000023A5C7F0000-0x0000023A5C800000-memory.dmp

Filesize
64KB

Download
memory/3532-27-0x0000023A5B7F0000-0x0000023A5B800000-memory.dmp

Filesize
64KB

Download
memory/3532-30-0x0000023A5B810000-0x0000023A5B820000-memory.dmp

Filesize
64KB

Download
memory/3532-31-0x0000023A5C840000-0x0000023A5C850000-memory.dmp

Filesize
64KB

Download
memory/3532-32-0x0000023A5CB80000-0x0000023A5CB90000-memory.dmp

Filesize
64KB

Download
memory/3532-33-0x0000023A5CC50000-0x0000023A5CC60000-memory.dmp

Filesize
64KB

Download
memory/3532-29-0x0000023A5CC40000-0x0000023A5CC50000-memory.dmp

Filesize
64KB

Download
memory/3532-23-0x0000023A5B4A0000-0x0000023A5B4B0000-memory.dmp

Filesize
64KB

Download
memory/3532-22-0x0000023A5B7E0000-0x0000023A5B7F0000-memory.dmp

Filesize
64KB

Download
memory/3532-18-0x0000023A5B480000-0x0000023A5B490000-memory.dmp

Filesize
64KB

Download
memory/3532-17-0x00007FFC08240000-0x00007FFC08250000-memory.dmp

Filesize
64KB

Download
memory/3532-14-0x00000239F5DC0000-0x00000239F5DD0000-memory.dmp

Filesize
64KB

Download
memory/3532-37-0x00000239B3D70000-0x00000239B3D80000-memory.dmp

Filesize
64KB

Download
memory/3532-38-0x0000023A5DC50000-0x0000023A5DC60000-memory.dmp

Filesize
64KB

Download
memory/3532-39-0x0000023A5DC60000-0x0000023A5DC70000-memory.dmp

Filesize
64KB

Download
memory/3532-40-0x00000239F5D90000-0x00000239F5DA0000-memory.dmp

Filesize
64KB

Download
memory/3532-43-0x0000023A5CC70000-0x0000023A5CC80000-memory.dmp

Filesize
64KB

Download
memory/3532-42-0x00000239F5DB0000-0x00000239F5DC0000-memory.dmp

Filesize
64KB

Download
memory/3532-41-0x00000239F5DA0000-0x00000239F5DB0000-memory.dmp

Filesize
64KB

Download
memory/3532-44-0x00000239F5E00000-0x00000239F5E10000-memory.dmp

Filesize
64KB

Download
memory/3532-45-0x00000239F5DC0000-0x00000239F5DD0000-memory.dmp

Filesize
64KB

Download
memory/3532-47-0x0000023A5DE70000-0x0000023A5DE80000-memory.dmp

Filesize
64KB

Download
memory/3532-49-0x0000023A5B480000-0x0000023A5B490000-memory.dmp

Filesize
64KB

Download
memory/3532-48-0x0000023A5DC80000-0x0000023A5DC90000-memory.dmp

Filesize
64KB

Download
memory/3532-46-0x0000023A5DC70000-0x0000023A5DC80000-memory.dmp

Filesize
64KB

Download
memory/3532-50-0x0000023A5B490000-0x0000023A5B4A0000-memory.dmp

Filesize
64KB

Download
memory/3532-51-0x0000023A5E190000-0x0000023A5E1A0000-memory.dmp

Filesize
64KB

Download
memory/3532-52-0x0000023A5B7E0000-0x0000023A5B7F0000-memory.dmp

Filesize
64KB

Download
memory/3532-54-0x0000023A5B810000-0x0000023A5B820000-memory.dmp

Filesize
64KB

Download
memory/3532-55-0x000002384FC70000-0x000002384FC80000-memory.dmp

Filesize
64KB

Download
memory/3532-57-0x0000023A5CB80000-0x0000023A5CB90000-memory.dmp

Filesize
64KB

Download
memory/3532-74-0x0000023A5DE70000-0x0000023A5DE80000-memory.dmp

Filesize
64KB

Download
memory/3532-73-0x00000239B3D70000-0x00000239B3D80000-memory.dmp

Filesize
64KB

Download
memory/3532-72-0x0000023A5DC70000-0x0000023A5DC80000-memory.dmp

Filesize
64KB

Download
memory/3532-71-0x0000023A5CC70000-0x0000023A5CC80000-memory.dmp

Filesize
64KB

Download
memory/3532-70-0x0000023A5CC40000-0x0000023A5CC50000-memory.dmp

Filesize
64KB

Download
memory/3532-69-0x0000023A5C7F0000-0x0000023A5C800000-memory.dmp

Filesize
64KB

Download
memory/3532-68-0x000002384FD90000-0x000002384FDA0000-memory.dmp

Filesize
64KB

Download
memory/3532-67-0x0000023A5CC50000-0x0000023A5CC60000-memory.dmp

Filesize
64KB

Download
memory/3532-66-0x0000023A5B7F0000-0x0000023A5B800000-memory.dmp

Filesize
64KB

Download
memory/3532-65-0x0000023A5B800000-0x0000023A5B810000-memory.dmp

Filesize
64KB

Download
memory/3532-64-0x0000023A5B490000-0x0000023A5B4A0000-memory.dmp

Filesize
64KB

Download
memory/3532-63-0x0000023A5B480000-0x0000023A5B490000-memory.dmp

Filesize
64KB

Download
memory/3532-62-0x0000023A5DC80000-0x0000023A5DC90000-memory.dmp

Filesize
64KB

Download
memory/3532-61-0x00000239F5E00000-0x00000239F5E10000-memory.dmp

Filesize
64KB

Download
memory/3532-60-0x0000023A5C840000-0x0000023A5C850000-memory.dmp

Filesize
64KB

Download
memory/3532-59-0x0000023A5DC60000-0x0000023A5DC70000-memory.dmp

Filesize
64KB

Download
memory/3532-58-0x0000023A5E190000-0x0000023A5E1A0000-memory.dmp

Filesize
64KB

Download
memory/3532-56-0x0000023A5E3B0000-0x0000023A5E3C0000-memory.dmp

Filesize
64KB

Download
memory/3532-53-0x0000023A5B4A0000-0x0000023A5B4B0000-memory.dmp

Filesize
64KB

Download