2c8a074a8ef08e067e38cd51c41c259c3407ceabeab6f597247871d630dc3012

Analysis

max time kernel
141s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).exe
Size

48.3MB
MD5

27e900e7e33c0bfa52a7d4c68103f3c9
SHA1

d96b1528c995c07ee9b4b87bc3b6d0a6ed44a467
SHA256

2c8a074a8ef08e067e38cd51c41c259c3407ceabeab6f597247871d630dc3012
SHA512

a4bbe2bcf385e1f2613685ccaa268be02cea95a9aa0709937f31f48a548debca534717c4e6a2f6b52af8e13488ec8aa65ff98d19e1ce42c84a923bcfb2b0e5de
SSDEEP

786432:CG1TS9wDg2LKVC+JyE97VSGGK60DQLXFtoYwfcCwkiTKtQKHbSZKuX:u0BLzO7sKBDQLXlywkiTKtlHbSQ2

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1580	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp

Loads dropped DLL 6 IoCs

pid	Process
1580	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp
1580	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp
1580	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp
1580	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp
1580	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp
1580	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 1580	4032	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).exe	90
PID 4032 wrote to memory of 1580	4032	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).exe	90
PID 4032 wrote to memory of 1580	4032	setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).exe	90

C:\Users\Admin\AppData\Local\Temp\setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).exe
"C:\Users\Admin\AppData\Local\Temp\setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\is-HB29J.tmp\setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HB29J.tmp\setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp" /SL5="$80206,50037545,192512,C:\Users\Admin\AppData\Local\Temp\setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\1207658688_english.jpg

Filesize
116KB

MD5
564fbffeb4a101fc1945b27b1ac2148b

SHA1
6b3786b434cb7cc43cc5b2ac9b026f4b271d659e

SHA256
d2491c946541d0e180b03be99bbd6580693936a2ef112bc4952addcd6ca2274a

SHA512
deec3bbd022ca832a5aeffb5ceb25c5ee57b78cc2708f219d8dd0b3581cdc5ef4069960ae877583237409ac82f478e799852190fc077008274cca51cbf4e98fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\1453458005_english.jpg

Filesize
180KB

MD5
b326484bb4f51558fe9d896eeaa118ba

SHA1
14411b96e4034f9b307d38d2991e68f228d9e220

SHA256
3037e7db3cdb858b1e62f4b754a9603c8d6ff7a91ba84141cce898f3ea6ac78b

SHA512
8de81f79cda454666097e65d8020dbafa05b7168dfac613da75c1f398e19ddc07e876f4d3fc7a034372c246ea4db7271b9a41213765e82900180f6a05256da7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\BigOK.png

Filesize
3KB

MD5
5b43a5d975a53f4fc1da67ce9f7784c1

SHA1
8543fa1e471030049942252b23cb22e0880c3af5

SHA256
59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a

SHA512
5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\EULAAccepted.png

Filesize
2KB

MD5
461dfeb75927bdb39f9db5348612a611

SHA1
b7893b1fff6801e37ee7337d876962a09184941e

SHA256
0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c

SHA512
68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\EULAShow.png

Filesize
1KB

MD5
c596bc9111edc702bbbb29b70984254f

SHA1
d4712c7b91ff4f8994e7907d31357c42eb47c738

SHA256
6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462

SHA512
db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\background.jpg

Filesize
374KB

MD5
c6a714eb3f5482b0a4db0a38593ea3a8

SHA1
2c83a8e3f42e30163f03903faf776bc4aac1d083

SHA256
c12cdbef7fbf16d367561e9eb05bde3019bd9b13dbddd7bca987d0d5829ec531

SHA512
32aa1813fa4429096eca83c6d713e8f80879c8b7adc0e52398035d6e210ca539d08ec87460316f83059132cd0dc952670fbc777c74d24ec56440905bf75ebaf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\btn_md5.png

Filesize
8KB

MD5
3befe9739354ee24a0b1ea8df05ce274

SHA1
ab0bda986a8c46aa19f57b75a2b7b22445a3c625

SHA256
b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47

SHA512
ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\crcdll.dll

Filesize
69KB

MD5
1d51fac9e2384eeb674199cfd5281d7d

SHA1
861dfdc121357d605d0cc3793266713788109eb2

SHA256
23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec

SHA512
921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\error.png

Filesize
726B

MD5
df10adc25b673e74e19971c17bee5a98

SHA1
ee16fb1cf9491f5e611282f0574b27d76fede412

SHA256
142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b

SHA512
dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\error_icon.png

Filesize
1KB

MD5
263720c4b8bb111567a2a49989b8f467

SHA1
cf346fa3c70164648e0eaf72a37c6f4920ab4792

SHA256
acdf96ee4261fae138e6350a0ad50b367022ed5b908fa168baad92644f566ee8

SHA512
94f06a81dc735cf264abde86e6169e5fd78d873d2e926fd48287d2ac5208fc930c3c432186e3510add002bd1b4ae32ad8d35270b17c3ce5f18c43764a8e9de43

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\ok.png

Filesize
1KB

MD5
103c1368e60806b1b7995a0894eacf87

SHA1
971392527f6e4b655044773132505c901a6b5469

SHA256
0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e

SHA512
652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\slideshow.ini

Filesize
285B

MD5
8630cb2c9452c51cca1a0ae7e32cd16a

SHA1
8933a57ffff8b031281dbe9fb6b44b4434e9b972

SHA256
3d92506f10a90fb534e8c4c994a97a0aaeb6a76ad9f52e516c5b04fb21f90aff

SHA512
4d2c7cd193dd5cdc315e804b3757d541c64ad695f81a1bc44170771d3d52bc3e9f0c0bc13aaf191661fdc6fbc924add9f3d53f108a947b7144278084ada5d1b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1RNO2.tmp\uninstall.dll

Filesize
691KB

MD5
7db706c324cc9b6fda497d081eed6e26

SHA1
ca97392e573af0cf61bfa3301801a85f2beea44c

SHA256
cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0

SHA512
8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HB29J.tmp\setup_rimworld_-_biotech_1.4.3901_rev218_(64bit)_(68699).tmp

Filesize
1.3MB

MD5
b6c4b66a8e5dc93d6cbd34efdf171c58

SHA1
6277579ceba50a1c99a0e2b198c708c22ceeabff

SHA256
6c341827b63014088efbd06ae6d7206d050b5153a5fe6eab374150af0f42042a

SHA512
6b3c9c0a9f34e136e5c45d61918006a17e7c957a8a8b06c53494373eac60ba043989b1b8545c6b94a9b01cd2bd268d1dc6e661188fab0fc317139b3216469305

Download Submit
memory/1580-142-0x0000000003950000-0x0000000003951000-memory.dmp

Filesize
4KB

Download
memory/1580-147-0x0000000006B70000-0x0000000006B7E000-memory.dmp

Filesize
56KB

Download
memory/1580-15-0x0000000003BF0000-0x0000000003CA7000-memory.dmp

Filesize
732KB

Download
memory/1580-158-0x0000000006B70000-0x0000000006B7E000-memory.dmp

Filesize
56KB

Download
memory/1580-156-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1580-60-0x0000000006B70000-0x0000000006B7E000-memory.dmp

Filesize
56KB

Download
memory/1580-153-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/1580-144-0x0000000000480000-0x00000000005D2000-memory.dmp

Filesize
1.3MB

Download
memory/1580-145-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1580-146-0x0000000003BF0000-0x0000000003CA7000-memory.dmp

Filesize
732KB

Download
memory/1580-6-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4032-143-0x0000000000730000-0x0000000000769000-memory.dmp

Filesize
228KB

Download
memory/4032-2-0x0000000000730000-0x0000000000769000-memory.dmp

Filesize
228KB

Download
memory/4032-0-0x0000000000730000-0x0000000000769000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads