e88d143ddd3dabd68e76a311de188da86ef6df032c96e5970837bda8ce33939e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[VALVe] Aimbot v4/[Valve] Aimbot v4.exe
Size

169KB
MD5

8c782ae2288964a41fc5e5077d8a641d
SHA1

4bca612805b21e44233469b7b147223ae8496059
SHA256

1d7a57b2fc862d6301b4d40ebcbcfcc0e9bcb3ba69bea02486617b62af22960e
SHA512

e65f24e509b0d36697107be498e681e1b47da440446120104bf144ad9b6378fafa5e8ae3f5a0829b53a35b57e5295372ffd1080bb172bf58481c71cb0a99e1bd
SSDEEP

3072:ISLEJYKou2ZR8GMFdrukEUTKSNrVMP0BByGXWGPAT7Zot9zH5FjA51K1kpYU8W6g:IiEJ9GMFJAY/ePV2+T7aNRa5p2W6RU6O

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2340	uh9qon0.exe

Loads dropped DLL 2 IoCs

pid	Process
2364	[Valve] Aimbot v4.exe
2364	[Valve] Aimbot v4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2340	2364	[Valve] Aimbot v4.exe	28
PID 2364 wrote to memory of 2340	2364	[Valve] Aimbot v4.exe	28
PID 2364 wrote to memory of 2340	2364	[Valve] Aimbot v4.exe	28
PID 2364 wrote to memory of 2340	2364	[Valve] Aimbot v4.exe	28

C:\Users\Admin\AppData\Local\Temp\[VALVe] Aimbot v4\[Valve] Aimbot v4.exe
"C:\Users\Admin\AppData\Local\Temp\[VALVe] Aimbot v4\[Valve] Aimbot v4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Roaming\uh9qon0.exe
  "C:\Users\Admin\AppData\Roaming\uh9qon0.exe"
  2⤵
  - Executes dropped EXE
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\uh9qon0.exe

Filesize
135KB

MD5
e53801f14eba10e59b762593589bb0ae

SHA1
e8c0cfb8514a61beacc11614c1cff56315ef4741

SHA256
a209f8c3502838a276845d5acbf1b91cfb10599e2373e231a35805e645e5e839

SHA512
6869106c5bcaa313cd7f5f4401c6217cdb49752e9a383d2c21c0da58891bb76880116d3b41395415adc2f9e56345e4dc9e26236bf2c93530dd8bf8c035be6a73

Download Submit