Overview
overview
7Static
static
7Cat.Goes.F...19.rar
windows7-x64
7Cat.Goes.F...19.rar
windows10-2004-x64
7Cat.Goes.F...ng.exe
windows7-x64
7Cat.Goes.F...ng.exe
windows10-2004-x64
7Cat.Goes.F...43.dll
windows7-x64
1Cat.Goes.F...43.dll
windows10-2004-x64
1Cat.Goes.F...ts.bin
windows7-x64
3Cat.Goes.F...ts.bin
windows10-2004-x64
3Cat.Goes.F...ts.bin
windows7-x64
3Cat.Goes.F...ts.bin
windows10-2004-x64
3Cat.Goes.F...ID.cfg
windows7-x64
3Cat.Goes.F...ID.cfg
windows10-2004-x64
3Cat.Goes.F...up.exe
windows7-x64
7Cat.Goes.F...up.exe
windows10-2004-x64
7Cat.Goes.F...st.exe
windows7-x64
7Cat.Goes.F...st.exe
windows10-2004-x64
6Cat.Goes.F...86.exe
windows7-x64
7Cat.Goes.F...86.exe
windows10-2004-x64
7Cat.Goes.F...ta.win
windows7-x64
3Cat.Goes.F...ta.win
windows10-2004-x64
3Cat.Goes.F...on.ogg
windows7-x64
1Cat.Goes.F...on.ogg
windows10-2004-x64
7Cat.Goes.F...ow.ogg
windows7-x64
1Cat.Goes.F...ow.ogg
windows10-2004-x64
7Cat.Goes.F...os.ogg
windows7-x64
1Cat.Goes.F...os.ogg
windows10-2004-x64
7Cat.Goes.F...ns.ini
windows7-x64
1Cat.Goes.F...ns.ini
windows10-2004-x64
1Cat.Goes.F...pi.dll
windows7-x64
7Cat.Goes.F...pi.dll
windows10-2004-x64
7Cat.Goes.F...pi.dll
windows7-x64
1Cat.Goes.F...pi.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/03/2024, 22:39
Behavioral task
behavioral1
Sample
Cat.Goes.Fishing.v13.11.2019.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Cat.Goes.Fishing.v13.11.2019.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Cat.Goes.Fishing.v13.11.2019/Cat Goes Fishing.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Cat.Goes.Fishing.v13.11.2019/Cat Goes Fishing.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Cat.Goes.Fishing.v13.11.2019/D3DX9_43.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Cat.Goes.Fishing.v13.11.2019/D3DX9_43.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Achievements.bin
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Achievements.bin
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Stats.bin
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Stats.bin
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/SteamUserID.cfg
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/SteamUserID.cfg
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/dxwebsetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/dxwebsetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/oalinst.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/oalinst.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/vcredist_x86.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/vcredist_x86.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Cat.Goes.Fishing.v13.11.2019/data.win
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Cat.Goes.Fishing.v13.11.2019/data.win
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Cat.Goes.Fishing.v13.11.2019/music_EasyLemon.ogg
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Cat.Goes.Fishing.v13.11.2019/music_EasyLemon.ogg
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Cat.Goes.Fishing.v13.11.2019/music_IceFlow.ogg
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Cat.Goes.Fishing.v13.11.2019/music_IceFlow.ogg
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Cat.Goes.Fishing.v13.11.2019/music_NightOfChaos.ogg
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
Cat.Goes.Fishing.v13.11.2019/music_NightOfChaos.ogg
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Cat.Goes.Fishing.v13.11.2019/options.ini
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
Cat.Goes.Fishing.v13.11.2019/options.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Cat.Goes.Fishing.v13.11.2019/steam_api.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Cat.Goes.Fishing.v13.11.2019/steam_api.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Cat.Goes.Fishing.v13.11.2019/steam_api.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Cat.Goes.Fishing.v13.11.2019/steam_api.dll
Resource
win10v2004-20240226-en
General
-
Target
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/SteamUserID.cfg
-
Size
61B
-
MD5
b4a0699180340c9f8dad77d7baf0e6df
-
SHA1
c59bd474a84fccf0fe698fbbd26b40cc61a89a3f
-
SHA256
0df1701f4b1bedb3de2696137b67b89b2c018e23d19048fa953ae39de22c7b89
-
SHA512
7f0a7c09ddab8260954a9b7a4e29c7b43a6646d9b7f1ec59be657ef953d1102df695798f8937b7d44a4250a87112bfb72c9d1dc4c91e0e7cdae52e57986aaed2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\cfg_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.cfg rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\cfg_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\cfg_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\cfg_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\cfg_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.cfg\ = "cfg_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2432 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2432 AcroRd32.exe 2432 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2140 wrote to memory of 3068 2140 cmd.exe 29 PID 2140 wrote to memory of 3068 2140 cmd.exe 29 PID 2140 wrote to memory of 3068 2140 cmd.exe 29 PID 3068 wrote to memory of 2432 3068 rundll32.exe 30 PID 3068 wrote to memory of 2432 3068 rundll32.exe 30 PID 3068 wrote to memory of 2432 3068 rundll32.exe 30 PID 3068 wrote to memory of 2432 3068 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Profile\IGGGAMES\SteamUserID.cfg1⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Profile\IGGGAMES\SteamUserID.cfg2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Profile\IGGGAMES\SteamUserID.cfg"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2432
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5bee64e69a532ffa6fc043a94e54f4b06
SHA1397d15983d5e0e289f23a7713cf3a12711fba72c
SHA256954f9866a6d4d7655d95bea87354fdae824d1bf66f7effb109bc905432840f92
SHA512c7037c1dbd84464a77a7ed5a2a6a448abe01b9e06a489980ac10fc127636cb0a93f39735604a1f105f2601cdb81099462861cd58ec2974cf9f34077f9a943e94