Analysis

  • max time kernel
    156s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 22:18

General

  • Target

    ArenaWarSetup.exe

  • Size

    139.9MB

  • MD5

    3e202bb9a1dd5a69f26a924287ae21c9

  • SHA1

    28ae516f8e784ac8a3e91a3deed9f1c7c1393a98

  • SHA256

    d455f3a0b04ba38c2e18098a5705724d9c20f0a16511a82927f7e9a6cff344c7

  • SHA512

    daeac00c25cc7cb204b9ca66689da547ce66766191f3acf90dcbc6ff5b5d9a1d42c0b4fed93091d0c2a396365c059da20d8f95578fbb831697a4e400f7fc626e

  • SSDEEP

    1572864:k2Cm7gJKfVjsPawuFHNwczWTeMkF7ZEk8bCkKbj:baodJFek8+k

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1216 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2976
      • C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --mojo-platform-channel-handle=1384 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:2348
        • C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe
          "C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1612 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Checks computer location settings
          PID:2500
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
            PID:1624
            • C:\Windows\system32\tasklist.exe
              tasklist
              3⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:620
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
            2⤵
              PID:2480
              • C:\Windows\system32\reg.exe
                C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
                3⤵
                  PID:1516
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
                2⤵
                  PID:1936
                  • C:\Windows\system32\reg.exe
                    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
                    3⤵
                      PID:1520
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
                    2⤵
                      PID:1280
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1500
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                      2⤵
                        PID:2396
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic path win32_VideoController get name
                          3⤵
                          • Detects videocard installed
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1864
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
                        2⤵
                          PID:1260
                          • C:\Windows\system32\cmd.exe
                            cmd /c chcp 65001
                            3⤵
                              PID:1200
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                4⤵
                                  PID:1052
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show profiles
                                3⤵
                                  PID:752
                              • C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe
                                "C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                2⤵
                                  PID:1872
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"
                                  2⤵
                                    PID:2656
                                    • C:\Windows\system32\reg.exe
                                      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f
                                      3⤵
                                      • Adds Run key to start application
                                      PID:2356
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                    2⤵
                                      PID:2560
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist
                                        3⤵
                                        • Enumerates processes with tasklist
                                        PID:1564
                                    • C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe
                                      "C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1684 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                      2⤵
                                        PID:2764

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Antivirus.txt

                                      Filesize

                                      231B

                                      MD5

                                      dec2be4f1ec3592cea668aa279e7cc9b

                                      SHA1

                                      327cf8ab0c895e10674e00ea7f437784bb11d718

                                      SHA256

                                      753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

                                      SHA512

                                      81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

                                    • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

                                      Filesize

                                      249B

                                      MD5

                                      cf7e4a12f932a3fddddacc8b10e1f1b0

                                      SHA1

                                      db6f9bc2be5e0905086b7b7b07109ef8d67b24ee

                                      SHA256

                                      1b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b

                                      SHA512

                                      fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c

                                    • C:\Users\Admin\AppData\Roaming\Video game\Local Storage\leveldb\CURRENT~RFf76b155.TMP

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • \Users\Admin\AppData\Local\Temp\5af6430e-b2a2-4391-94f4-44371ecc44d8.tmp.node

                                      Filesize

                                      2.7MB

                                      MD5

                                      34338c8a774bc30c223f228b3ef394bb

                                      SHA1

                                      98ae6592b53d35261b1a122d5b60bea7a8d8fb96

                                      SHA256

                                      d868ca7a24ce77b9ed0d78ce2e75e85f7c342888def0b8d65a9a965b81d3e1ab

                                      SHA512

                                      b728b18adc32111c53210282dae660fea7bab66e6dee4ae62f8761e5e8cb1ff4db3420a04d861a60949221d8611b0fa0d02d4963ae1a3d338d0f7f4af20a90f7

                                    • \Users\Admin\AppData\Local\Temp\7a993de5-d8cb-4921-8afb-06287cb76501.tmp.node

                                      Filesize

                                      641KB

                                      MD5

                                      b68521b5ef83bcfa58f1e00b19988cfc

                                      SHA1

                                      2a5d9afd619e2a57df212730a8b8566dc3fcf824

                                      SHA256

                                      0f666f8eb35b704692d0c78557b5a0cc0858a4b1422b53d3cae11785e057a56a

                                      SHA512

                                      2c2db152a9ef51e2f6177f09c98fa58f998aed5775a500f81191c40a31e1185ec833e7c5ecbe84f59665b03e06e38d5070f4145ab46c652109c49a264ddca960

                                    • memory/2372-18-0x0000000002A80000-0x0000000002A81000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2976-5-0x0000000000060000-0x0000000000061000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2976-37-0x0000000077C00000-0x0000000077C01000-memory.dmp

                                      Filesize

                                      4KB