Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2024, 09:13

General

  • Target

    [FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe

  • Size

    6.3MB

  • MD5

    4c37c102a240b35cac574ad70c9be545

  • SHA1

    44c8c744c420e7744694b0b15be59bbf598c4fd0

  • SHA256

    efbdde22bb6a09acd4782f0e11ef49de59491acc431700ceba6bc5f184f39765

  • SHA512

    9d99bfe91bd57c18842f1d0c036eec1357688d9af344343f3639a070857391a544ee7cd57986ed0652fcf54f58e768537c988276105699b7f333887bcf50d9fa

  • SSDEEP

    98304:ATp6Nv/WiEKDxTY/Utas2r7aFB6tK0d1oXtvtlpCmnWJMOgnsARBFaADs6UDgk9X:AoNv/WwxTAUAZ7aFh0DoBcXJMb/e6Uxp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe
    "C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\is-DJO5Q.tmp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DJO5Q.tmp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.tmp" /SL5="$70120,6111299,152064,C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Checks processor information in registry
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3008
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2784
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1816

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\is-DJO5Q.tmp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.tmp

        Filesize

        1.4MB

        MD5

        7300211c571951be86be6c6f8cdfc09d

        SHA1

        5464e16689003406513c7677b3d970f673551d18

        SHA256

        e77c3184d90f6e7a1276bb8389aba06296be97deb2e8a3433ca9a537538696da

        SHA512

        9c340edcd63c87565a9de26892d2e83647798583cc942bf608b54e86b8fd36bc2ad64421241b88f0a0682e7c006a5af712e62d3231ca5a81264d8b1a1905ebb4

      • C:\Users\Admin\AppData\Local\Temp\is-NLTJ7.tmp\CheckBox.png

        Filesize

        7KB

        MD5

        abd301b0263b0e0cebdd71e4855ac7d3

        SHA1

        1e8480c3f3b47a5daa7cb1183b6a7a49998cda6e

        SHA256

        aff003e75bbf410ed2f7ca8728afe01ab4a517536647ad20109d00c4adf570d5

        SHA512

        b5abb188bd23d7fc2e3253a5639cc3eba6d21774dba55b43395cf84ddb49fe707ad54dc0a7f157e6b0804c1662d9c4cb4bef2787aafb194ea73fbebd1a63bb6b

      • C:\Users\Admin\AppData\Local\Temp\is-NLTJ7.tmp\WizardImage.jpg

        Filesize

        62KB

        MD5

        b91658597f15d7f689c86f5a2e7824bd

        SHA1

        00da609aa0b39140b767a3bc2644433d64edbd71

        SHA256

        b3cda6ab45ad5aa6a0a5f700d2c8987b3c1c1ebda63165d9bd5a566b24dcbd84

        SHA512

        00b287fb14b947edf4b16d52243e9a992595d8894e83d8590473103d1b54a4670b323db13c4f78234617c44f905baf517e68fcceaad313f3ea7cd44cf036daea

      • C:\Users\Admin\AppData\Local\Temp\is-NLTJ7.tmp\button.png

        Filesize

        12KB

        MD5

        51af4120d6d22b1126cc87a5143740ef

        SHA1

        1cb4e91e765537a72c9628056d29fbd6a7ce515c

        SHA256

        c74fed62141f7e666379a0b00d5b39c86975332cf08151cbe8cab88eff2c393c

        SHA512

        2595be954684ca34bc9284337524a5191c72fbea46b59555a5113ed8404a1e7ab6c2aa0f5a975f832cccdd8934ff1140c679ecd940f31cc14b4c3a362a225cbc

      • \Users\Admin\AppData\Local\Temp\is-DJO5Q.tmp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.tmp

        Filesize

        1.1MB

        MD5

        c85fac84da02dffe28078376ff24e998

        SHA1

        b4f5da626333f4962b9123dad2660c60cd4fcff5

        SHA256

        ec77b303ef4690bacf87cc1998597938343f7c10cd3fe6918afb136b1fbf4538

        SHA512

        0642c50ff5bcd9c481e60b0d4588333a8a0d1ac0ef78c6e39e09a5d20998a5feb12b4537037f6b6388d2dfea569945dba9abe0d68529b66ae7b216c194383ab5

      • \Users\Admin\AppData\Local\Temp\is-NLTJ7.tmp\_isetup\_shfoldr.dll

        Filesize

        22KB

        MD5

        92dc6ef532fbb4a5c3201469a5b5eb63

        SHA1

        3e89ff837147c16b4e41c30d6c796374e0b8e62c

        SHA256

        9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

        SHA512

        9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

      • \Users\Admin\AppData\Local\Temp\is-NLTJ7.tmp\botva2.dll

        Filesize

        32KB

        MD5

        295832fa6400cb3407cfe84b06785531

        SHA1

        7068910c2e0ea7f4535c770517e29d9c2d2ee77b

        SHA256

        13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784

        SHA512

        50516f9761efd14641f65bd773cfdd50c4ab0de977e094ba9227796dc319d9330321c7914243fc7dc04b5716752395f8dac8ccdfdb98ba7e5f5c1172408ce57b

      • \Users\Admin\AppData\Local\Temp\is-NLTJ7.tmp\get_hw_caps.dll

        Filesize

        76KB

        MD5

        2e35d2894df3b691dbd8e0d4f4c84efc

        SHA1

        d0fc14963e397d185e9f2d7dea1d07bc6308d5b9

        SHA256

        869079ba362cbc560d673db290248ec2aa075a74f22a82d90621f1118f8e1c4d

        SHA512

        29ba662ab2e77aef0547ff76213a1b6ef52be27a446923790a27cf8b69377621048387dbb9f22001b6d15837dddada84c7350614ec9622258319658822705f90

      • \Users\Admin\AppData\Local\Temp\is-NLTJ7.tmp\innocallback.dll

        Filesize

        63KB

        MD5

        1c55ae5ef9980e3b1028447da6105c75

        SHA1

        f85218e10e6aa23b2f5a3ed512895b437e41b45c

        SHA256

        6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

        SHA512

        1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

      • memory/3008-113-0x00000000020E0000-0x00000000020ED000-memory.dmp

        Filesize

        52KB

      • memory/3008-117-0x00000000020E0000-0x00000000020ED000-memory.dmp

        Filesize

        52KB

      • memory/3008-7-0x00000000001D0000-0x00000000001D1000-memory.dmp

        Filesize

        4KB

      • memory/3008-109-0x0000000003850000-0x0000000003950000-memory.dmp

        Filesize

        1024KB

      • memory/3008-140-0x0000000000400000-0x000000000057B000-memory.dmp

        Filesize

        1.5MB

      • memory/3008-112-0x0000000000400000-0x000000000057B000-memory.dmp

        Filesize

        1.5MB

      • memory/3008-35-0x00000000020E0000-0x00000000020ED000-memory.dmp

        Filesize

        52KB

      • memory/3008-114-0x0000000003800000-0x0000000003815000-memory.dmp

        Filesize

        84KB

      • memory/3008-116-0x0000000000400000-0x000000000057B000-memory.dmp

        Filesize

        1.5MB

      • memory/3008-75-0x0000000003800000-0x0000000003815000-memory.dmp

        Filesize

        84KB

      • memory/3008-118-0x0000000003800000-0x0000000003815000-memory.dmp

        Filesize

        84KB

      • memory/3008-119-0x00000000001D0000-0x00000000001D1000-memory.dmp

        Filesize

        4KB

      • memory/3008-120-0x0000000003850000-0x0000000003950000-memory.dmp

        Filesize

        1024KB

      • memory/3008-122-0x0000000003850000-0x0000000003950000-memory.dmp

        Filesize

        1024KB

      • memory/3008-127-0x0000000000400000-0x000000000057B000-memory.dmp

        Filesize

        1.5MB

      • memory/3012-111-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/3012-0-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB