a0f4104801d1d248028bd51f896d752aef1f183c2d4f85a396234880dc3ce4a0

Analysis

max time kernel
136s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mindustry.exe
Size

584KB
MD5

07f788dd556b612fd064a73913f82bfc
SHA1

3abe2d614dc63ca4d6b9907d36d5c35bd54cf020
SHA256

f9afb4ade0ba4d8cd758fabdb9cd76af2c72b59130140604b29cf02295b74569
SHA512

68de704e7248e647744a44c5cc46b08c97f5c80ae73e009b6c45367dd6691bb331b6d3cf7a0d4503c60be1361f59c734499c77ba1ea5b5b8448a44d5d3385e38
SSDEEP

12288:cPpWdd4P5jtbIHMavP0JLk2KgszHpaHwZMTVLzRBYkd2pA7okT1KP:cPpWdd4P5jtbIHMavP0JLk2KgszHpaQE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	Mindustry.exe

Loads dropped DLL 2 IoCs

pid	Process
3948	Mindustry.exe
3948	Mindustry.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Mindustry.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Mindustry.exe

C:\Users\Admin\AppData\Local\Temp\Mindustry.exe
"C:\Users\Admin\AppData\Local\Temp\Mindustry.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\arc\5f24d8af\arc64.dll

Filesize
277KB

MD5
ce15f741c8cace2c5383c24d8ccf9f56

SHA1
7ceff058738cd18b47528cf20246261cb1dd99fb

SHA256
725f2feba2b45504a693381de5581c448f84d6453a5fe6f3224f90865bf02189

SHA512
fa1bc74f66c0c1dfd6da818ef65dfd4ddcc42e3877bc85b0ff090d89c98ae4697649a0f806758fa34339541b75f6b8b1a5bfc8a912ad0b32c3f9ab9b881d3d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\arc\d279e965\sdl-arc64.dll

Filesize
2.4MB

MD5
266a50b05160ec7d3162a9b1e2dc3256

SHA1
d6dea436759164a37406333ddb3e5bc462d25e78

SHA256
e2b56d39567bc6085fb7e1acfb42a9550efe58ab30892bbed6e0280335ed27ec

SHA512
6921cd2b2c977f8b1e469b6d63a010585d6454c9a5cf4049c2ec64491437d42462faad40f26cac7629c6156d9b8f3dc9381cabaef9ec4a18455cc97336da3ba1

Download Submit
memory/3948-8-0x0000017ACB0B0000-0x0000017ACC0B0000-memory.dmp

Filesize
16.0MB

Download
memory/3948-17-0x0000017ACB0B0000-0x0000017ACC0B0000-memory.dmp

Filesize
16.0MB

Download
memory/3948-21-0x0000017ACB0B0000-0x0000017ACC0B0000-memory.dmp

Filesize
16.0MB

Download
memory/3948-25-0x0000000065ED0000-0x0000000065F98000-memory.dmp

Filesize
800KB

Download
memory/3948-26-0x0000000065C50000-0x0000000065ECC000-memory.dmp

Filesize
2.5MB

Download
memory/3948-28-0x0000000065ED0000-0x0000000065F98000-memory.dmp

Filesize
800KB

Download
memory/3948-29-0x0000000065C50000-0x0000000065ECC000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads