Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22/02/2024, 09:13
General
-
Target
[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe
-
Size
6.3MB
-
MD5
4c37c102a240b35cac574ad70c9be545
-
SHA1
44c8c744c420e7744694b0b15be59bbf598c4fd0
-
SHA256
efbdde22bb6a09acd4782f0e11ef49de59491acc431700ceba6bc5f184f39765
-
SHA512
9d99bfe91bd57c18842f1d0c036eec1357688d9af344343f3639a070857391a544ee7cd57986ed0652fcf54f58e768537c988276105699b7f333887bcf50d9fa
-
SSDEEP
98304:ATp6Nv/WiEKDxTY/Utas2r7aFB6tK0d1oXtvtlpCmnWJMOgnsARBFaADs6UDgk9X:AoNv/WwxTAUAZ7aFh0DoBcXJMb/e6Uxp
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe"C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DJO5Q.tmp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.tmp"C:\Users\Admin\AppData\Local\Temp\is-DJO5Q.tmp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.tmp" /SL5="$70120,6111299,152064,C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD57300211c571951be86be6c6f8cdfc09d
SHA15464e16689003406513c7677b3d970f673551d18
SHA256e77c3184d90f6e7a1276bb8389aba06296be97deb2e8a3433ca9a537538696da
SHA5129c340edcd63c87565a9de26892d2e83647798583cc942bf608b54e86b8fd36bc2ad64421241b88f0a0682e7c006a5af712e62d3231ca5a81264d8b1a1905ebb4
-
Filesize
7KB
MD5abd301b0263b0e0cebdd71e4855ac7d3
SHA11e8480c3f3b47a5daa7cb1183b6a7a49998cda6e
SHA256aff003e75bbf410ed2f7ca8728afe01ab4a517536647ad20109d00c4adf570d5
SHA512b5abb188bd23d7fc2e3253a5639cc3eba6d21774dba55b43395cf84ddb49fe707ad54dc0a7f157e6b0804c1662d9c4cb4bef2787aafb194ea73fbebd1a63bb6b
-
Filesize
62KB
MD5b91658597f15d7f689c86f5a2e7824bd
SHA100da609aa0b39140b767a3bc2644433d64edbd71
SHA256b3cda6ab45ad5aa6a0a5f700d2c8987b3c1c1ebda63165d9bd5a566b24dcbd84
SHA51200b287fb14b947edf4b16d52243e9a992595d8894e83d8590473103d1b54a4670b323db13c4f78234617c44f905baf517e68fcceaad313f3ea7cd44cf036daea
-
Filesize
12KB
MD551af4120d6d22b1126cc87a5143740ef
SHA11cb4e91e765537a72c9628056d29fbd6a7ce515c
SHA256c74fed62141f7e666379a0b00d5b39c86975332cf08151cbe8cab88eff2c393c
SHA5122595be954684ca34bc9284337524a5191c72fbea46b59555a5113ed8404a1e7ab6c2aa0f5a975f832cccdd8934ff1140c679ecd940f31cc14b4c3a362a225cbc
-
Filesize
1.1MB
MD5c85fac84da02dffe28078376ff24e998
SHA1b4f5da626333f4962b9123dad2660c60cd4fcff5
SHA256ec77b303ef4690bacf87cc1998597938343f7c10cd3fe6918afb136b1fbf4538
SHA5120642c50ff5bcd9c481e60b0d4588333a8a0d1ac0ef78c6e39e09a5d20998a5feb12b4537037f6b6388d2dfea569945dba9abe0d68529b66ae7b216c194383ab5
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
32KB
MD5295832fa6400cb3407cfe84b06785531
SHA17068910c2e0ea7f4535c770517e29d9c2d2ee77b
SHA25613e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784
SHA51250516f9761efd14641f65bd773cfdd50c4ab0de977e094ba9227796dc319d9330321c7914243fc7dc04b5716752395f8dac8ccdfdb98ba7e5f5c1172408ce57b
-
Filesize
76KB
MD52e35d2894df3b691dbd8e0d4f4c84efc
SHA1d0fc14963e397d185e9f2d7dea1d07bc6308d5b9
SHA256869079ba362cbc560d673db290248ec2aa075a74f22a82d90621f1118f8e1c4d
SHA51229ba662ab2e77aef0547ff76213a1b6ef52be27a446923790a27cf8b69377621048387dbb9f22001b6d15837dddada84c7350614ec9622258319658822705f90
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
52KB
-
Filesize
84KB
-
Filesize
1.5MB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
188KB
-
Filesize
188KB
