Analysis

  • max time kernel
    156s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 04:31

General

  • Target

    Spacetherapy.exe

  • Size

    140.1MB

  • MD5

    acd88cdf7c30231a298c5eb919390c17

  • SHA1

    583d47d1186d84642b56b6e130b44315d96901d6

  • SHA256

    09636887b5fe1c9a9d09b5ee5b44e09bf498b0effb345b587548d6e919cc0898

  • SHA512

    e4d0f98b7698a2f479273344a40525afc2f001297ac1180a58055d9dd298faa5d00cbc6cb5bfd6edb4306e888751a6f11eb4ca045deea76151e4c2e26270c76d

  • SSDEEP

    1572864:A2Cm7gJKfVjsPawuFHNwczWTeMkF7ZEk8bCkKbj:XaodJFek8+k

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe
    "C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe
      "C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Spacetherapy is a game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1268,i,6892843901777050377,5403653751599801676,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2596
      • C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe
        "C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Spacetherapy is a game" --mojo-platform-channel-handle=1444 --field-trial-handle=1268,i,6892843901777050377,5403653751599801676,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:2652
        • C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe
          "C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Spacetherapy is a game" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1672 --field-trial-handle=1268,i,6892843901777050377,5403653751599801676,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Checks computer location settings
          PID:472
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
            PID:2072
            • C:\Windows\system32\tasklist.exe
              tasklist
              3⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:1504
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
            2⤵
              PID:1880
              • C:\Windows\system32\reg.exe
                C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
                3⤵
                  PID:584
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
                2⤵
                  PID:1720
                  • C:\Windows\system32\reg.exe
                    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
                    3⤵
                      PID:952
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
                    2⤵
                      PID:2440
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:648
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                      2⤵
                        PID:2128
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic path win32_VideoController get name
                          3⤵
                          • Detects videocard installed
                          • Suspicious use of AdjustPrivilegeToken
                          PID:788
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
                        2⤵
                          PID:2456
                          • C:\Windows\system32\cmd.exe
                            cmd /c chcp 65001
                            3⤵
                              PID:1160
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                4⤵
                                  PID:2252
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show profiles
                                3⤵
                                  PID:1544
                              • C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe
                                "C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Spacetherapy is a game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1268,i,6892843901777050377,5403653751599801676,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                2⤵
                                  PID:1060
                                • C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Spacetherapy.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Spacetherapy is a game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1296 --field-trial-handle=1268,i,6892843901777050377,5403653751599801676,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                  2⤵
                                    PID:2580

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Antivirus.txt

                                  Filesize

                                  231B

                                  MD5

                                  dec2be4f1ec3592cea668aa279e7cc9b

                                  SHA1

                                  327cf8ab0c895e10674e00ea7f437784bb11d718

                                  SHA256

                                  753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

                                  SHA512

                                  81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

                                • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

                                  Filesize

                                  249B

                                  MD5

                                  cf7e4a12f932a3fddddacc8b10e1f1b0

                                  SHA1

                                  db6f9bc2be5e0905086b7b7b07109ef8d67b24ee

                                  SHA256

                                  1b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b

                                  SHA512

                                  fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c

                                • C:\Users\Admin\AppData\Roaming\Spacetherapy is a game\Local Storage\leveldb\CURRENT~RFf76a1ea.TMP

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • \Users\Admin\AppData\Local\Temp\51c7e5dd-bbaf-4f82-8d53-8243d42ac881.tmp.node

                                  Filesize

                                  2.7MB

                                  MD5

                                  34338c8a774bc30c223f228b3ef394bb

                                  SHA1

                                  98ae6592b53d35261b1a122d5b60bea7a8d8fb96

                                  SHA256

                                  d868ca7a24ce77b9ed0d78ce2e75e85f7c342888def0b8d65a9a965b81d3e1ab

                                  SHA512

                                  b728b18adc32111c53210282dae660fea7bab66e6dee4ae62f8761e5e8cb1ff4db3420a04d861a60949221d8611b0fa0d02d4963ae1a3d338d0f7f4af20a90f7

                                • \Users\Admin\AppData\Local\Temp\82e4f215-39ed-4116-8a59-578d5d089a48.tmp.node

                                  Filesize

                                  641KB

                                  MD5

                                  dda2aef5ebb257d45540b7f0e0689a2b

                                  SHA1

                                  047eca7e2910ad495cdcbfd3e48487bcefcd6cf5

                                  SHA256

                                  ae009abe61c4eab96bd3be1683b5009069342eec123e0899f37137b57c1f7604

                                  SHA512

                                  70f2dfed4d161fc9465303806a73ffa0ccbd235a10a1378a282638a80112578d2deb37956dc7493adec187ac75611fd9a82797f2f308e195c0206c28e2eefcb2

                                • memory/2304-44-0x00000000026D0000-0x00000000026D1000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2596-5-0x0000000000060000-0x0000000000061000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2596-36-0x0000000077D50000-0x0000000077D51000-memory.dmp

                                  Filesize

                                  4KB