e88d143ddd3dabd68e76a311de188da86ef6df032c96e5970837bda8ce33939e

Analysis

max time kernel
132s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[VALVe] Aimbot v4/[Valve] Aimbot v4.exe
Size

169KB
MD5

8c782ae2288964a41fc5e5077d8a641d
SHA1

4bca612805b21e44233469b7b147223ae8496059
SHA256

1d7a57b2fc862d6301b4d40ebcbcfcc0e9bcb3ba69bea02486617b62af22960e
SHA512

e65f24e509b0d36697107be498e681e1b47da440446120104bf144ad9b6378fafa5e8ae3f5a0829b53a35b57e5295372ffd1080bb172bf58481c71cb0a99e1bd
SSDEEP

3072:ISLEJYKou2ZR8GMFdrukEUTKSNrVMP0BByGXWGPAT7Zot9zH5FjA51K1kpYU8W6g:IiEJ9GMFJAY/ePV2+T7aNRa5p2W6RU6O

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	[Valve] Aimbot v4.exe

Executes dropped EXE 1 IoCs

pid	Process
1128	u16i4zm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1128	3920	[Valve] Aimbot v4.exe	85
PID 3920 wrote to memory of 1128	3920	[Valve] Aimbot v4.exe	85
PID 3920 wrote to memory of 1128	3920	[Valve] Aimbot v4.exe	85

C:\Users\Admin\AppData\Local\Temp\[VALVe] Aimbot v4\[Valve] Aimbot v4.exe
"C:\Users\Admin\AppData\Local\Temp\[VALVe] Aimbot v4\[Valve] Aimbot v4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Roaming\u16i4zm.exe
  "C:\Users\Admin\AppData\Roaming\u16i4zm.exe"
  2⤵
  - Executes dropped EXE
  PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\u16i4zm.exe

Filesize
135KB

MD5
a70827f50f8d6948dc1e327c8abb5039

SHA1
84e7927ee81a2fe13d3902d002d205ca933a4424

SHA256
9199827ee1b17e455d0b0597a09d0215a86bf61af4ce8c6298f5ce8f97dc1f65

SHA512
d77a78c28e6e38978a4a0b607afa1741979b8b7a85e01c9244e7b346cf47bdd604f604aaa6bb2c350c90dde2b252c00af3d32354bbd2b41cb76ab3fbb6e0496e

Download Submit