dd5c06da329f69df379f795008640aa4d1e0afa9e8fd99e660132963c1e8a7c9

Analysis

max time kernel
37s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Palworld Early Access Plus 42 Trainer.exe
Size

2.0MB
MD5

82f0ed82e524d33031ed7831f2f8263d
SHA1

b77f09d1a34a414ac8feaf9b23206222722c7492
SHA256

dd5c06da329f69df379f795008640aa4d1e0afa9e8fd99e660132963c1e8a7c9
SHA512

8798a521fc37316477869868d8aab65b1bb9ff9e39e29355fd139ec6e649033942c12208c9240d330068453217794899e6b1731a930226941681aa0fe37f027a
SSDEEP

49152:y5n1oFbhwND9beeMcdrcTgXT5XaieWRp41:yubha9iz8D5qqY1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe
4060	Palworld Early Access Plus 42 Trainer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	Palworld Early Access Plus 42 Trainer.exe
Token: SeDebugPrivilege	4060	Palworld Early Access Plus 42 Trainer.exe

C:\Users\Admin\AppData\Local\Temp\Palworld Early Access Plus 42 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Palworld Early Access Plus 42 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\FLiNGTrainer\TrainerSettings.ini

Filesize
37B

MD5
a733986b23235e9df2ed8652044f4718

SHA1
a6b37ab6584096eee4e0bb79013773eb752bfe83

SHA256
e34c9e06cdd656e5b901c1eedd6d28aa595ceebd80e3c585218980fbd5a9c473

SHA512
635f58eed8f3af8e3b167b9b7825589e17f2aa638449961a11c4c54538c8d262fca7a35001dc3bd1a86aabe7030ddd03e66757aa6b3882ae7c8f99c8aa3389c6

Download Submit
memory/4060-8-0x000001F2AE030000-0x000001F2AE068000-memory.dmp

Filesize
224KB

Download
memory/4060-7-0x000001F2ADDA0000-0x000001F2ADDA8000-memory.dmp

Filesize
32KB

Download
memory/4060-3-0x000001F293980000-0x000001F293990000-memory.dmp

Filesize
64KB

Download
memory/4060-4-0x000001F293980000-0x000001F293990000-memory.dmp

Filesize
64KB

Download
memory/4060-9-0x000001F2ADDF0000-0x000001F2ADDFE000-memory.dmp

Filesize
56KB

Download
memory/4060-6-0x000001F293980000-0x000001F293990000-memory.dmp

Filesize
64KB

Download
memory/4060-2-0x000001F293980000-0x000001F293990000-memory.dmp

Filesize
64KB

Download
memory/4060-0-0x000001F2939A0000-0x000001F2939D4000-memory.dmp

Filesize
208KB

Download
memory/4060-5-0x000001F293980000-0x000001F293990000-memory.dmp

Filesize
64KB

Download
memory/4060-22-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/4060-23-0x000001F293980000-0x000001F293990000-memory.dmp

Filesize
64KB

Download
memory/4060-24-0x000001F293980000-0x000001F293990000-memory.dmp

Filesize
64KB

Download
memory/4060-27-0x000001F293980000-0x000001F293990000-memory.dmp

Filesize
64KB

Download
memory/4060-1-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/4060-32-0x000001F293980000-0x000001F293990000-memory.dmp

Filesize
64KB

Download
memory/4060-36-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download