Overview
overview
7Static
static
7Cat.Goes.F...19.rar
windows7-x64
7Cat.Goes.F...19.rar
windows10-2004-x64
7Cat.Goes.F...ng.exe
windows7-x64
7Cat.Goes.F...ng.exe
windows10-2004-x64
7Cat.Goes.F...43.dll
windows7-x64
1Cat.Goes.F...43.dll
windows10-2004-x64
1Cat.Goes.F...ts.bin
windows7-x64
3Cat.Goes.F...ts.bin
windows10-2004-x64
3Cat.Goes.F...ts.bin
windows7-x64
3Cat.Goes.F...ts.bin
windows10-2004-x64
3Cat.Goes.F...ID.cfg
windows7-x64
3Cat.Goes.F...ID.cfg
windows10-2004-x64
3Cat.Goes.F...up.exe
windows7-x64
7Cat.Goes.F...up.exe
windows10-2004-x64
7Cat.Goes.F...st.exe
windows7-x64
7Cat.Goes.F...st.exe
windows10-2004-x64
6Cat.Goes.F...86.exe
windows7-x64
7Cat.Goes.F...86.exe
windows10-2004-x64
7Cat.Goes.F...ta.win
windows7-x64
3Cat.Goes.F...ta.win
windows10-2004-x64
3Cat.Goes.F...on.ogg
windows7-x64
1Cat.Goes.F...on.ogg
windows10-2004-x64
7Cat.Goes.F...ow.ogg
windows7-x64
1Cat.Goes.F...ow.ogg
windows10-2004-x64
7Cat.Goes.F...os.ogg
windows7-x64
1Cat.Goes.F...os.ogg
windows10-2004-x64
7Cat.Goes.F...ns.ini
windows7-x64
1Cat.Goes.F...ns.ini
windows10-2004-x64
1Cat.Goes.F...pi.dll
windows7-x64
7Cat.Goes.F...pi.dll
windows10-2004-x64
7Cat.Goes.F...pi.dll
windows7-x64
1Cat.Goes.F...pi.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/03/2024, 22:39
Behavioral task
behavioral1
Sample
Cat.Goes.Fishing.v13.11.2019.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Cat.Goes.Fishing.v13.11.2019.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Cat.Goes.Fishing.v13.11.2019/Cat Goes Fishing.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Cat.Goes.Fishing.v13.11.2019/Cat Goes Fishing.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Cat.Goes.Fishing.v13.11.2019/D3DX9_43.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Cat.Goes.Fishing.v13.11.2019/D3DX9_43.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Achievements.bin
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Achievements.bin
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Stats.bin
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Stats.bin
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/SteamUserID.cfg
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/SteamUserID.cfg
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/dxwebsetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/dxwebsetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/oalinst.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/oalinst.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/vcredist_x86.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Cat.Goes.Fishing.v13.11.2019/_Redist/vcredist_x86.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Cat.Goes.Fishing.v13.11.2019/data.win
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Cat.Goes.Fishing.v13.11.2019/data.win
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Cat.Goes.Fishing.v13.11.2019/music_EasyLemon.ogg
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Cat.Goes.Fishing.v13.11.2019/music_EasyLemon.ogg
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Cat.Goes.Fishing.v13.11.2019/music_IceFlow.ogg
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Cat.Goes.Fishing.v13.11.2019/music_IceFlow.ogg
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Cat.Goes.Fishing.v13.11.2019/music_NightOfChaos.ogg
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
Cat.Goes.Fishing.v13.11.2019/music_NightOfChaos.ogg
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Cat.Goes.Fishing.v13.11.2019/options.ini
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
Cat.Goes.Fishing.v13.11.2019/options.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Cat.Goes.Fishing.v13.11.2019/steam_api.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Cat.Goes.Fishing.v13.11.2019/steam_api.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Cat.Goes.Fishing.v13.11.2019/steam_api.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Cat.Goes.Fishing.v13.11.2019/steam_api.dll
Resource
win10v2004-20240226-en
General
-
Target
Cat.Goes.Fishing.v13.11.2019/_Redist/dxwebsetup.exe
-
Size
281KB
-
MD5
fd6057b33e15a553ddc5d9873723ce8f
-
SHA1
f90efb623b5abea70af63c470daa8674444fb1df
-
SHA256
111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
-
SHA512
d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
-
SSDEEP
6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1724 dxwsetup.exe -
Loads dropped DLL 5 IoCs
pid Process 1592 dxwebsetup.exe 1724 dxwsetup.exe 1724 dxwsetup.exe 1724 dxwsetup.exe 1724 dxwsetup.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dxwebsetup.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup32.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET99CF.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET99CF.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET99F0.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET99F0.tmp dxwsetup.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DirectX.log dxwsetup.exe File opened for modification C:\Windows\INF\setupapi.app.log dxwsetup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1724 dxwsetup.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1724 dxwsetup.exe Token: SeRestorePrivilege 1724 dxwsetup.exe Token: SeRestorePrivilege 1724 dxwsetup.exe Token: SeRestorePrivilege 1724 dxwsetup.exe Token: SeRestorePrivilege 1724 dxwsetup.exe Token: SeRestorePrivilege 1724 dxwsetup.exe Token: SeRestorePrivilege 1724 dxwsetup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1592 wrote to memory of 1724 1592 dxwebsetup.exe 28 PID 1592 wrote to memory of 1724 1592 dxwebsetup.exe 28 PID 1592 wrote to memory of 1724 1592 dxwebsetup.exe 28 PID 1592 wrote to memory of 1724 1592 dxwebsetup.exe 28 PID 1592 wrote to memory of 1724 1592 dxwebsetup.exe 28 PID 1592 wrote to memory of 1724 1592 dxwebsetup.exe 28 PID 1592 wrote to memory of 1724 1592 dxwebsetup.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\_Redist\dxwebsetup.exe"C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\_Redist\dxwebsetup.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD50a23038ea472ffc938366ef4099d6635
SHA16499d741776dc4a446c22ea11085842155b34176
SHA2568f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a
SHA512dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88
-
Filesize
1.7MB
MD57672509436485121135c2a0e30b9e9ff
SHA1f557022a9f42fe1303078093e389f21fb693c959
SHA256d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea
SHA512e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863
-
Filesize
384KB
MD595af51a930889c82630553e5d9d24f4b
SHA1d24fe70a2152b09d1b85166443e24d2d61defdf5
SHA256b8c3d2b050e3541e4072d8522a63319ce53f48ce7c975d2b2f389db91df36865
SHA512faeafbeea9c190b33b5354ec9998cb285911cecf78c69acbe11a2de253e939494e5d72b8036e849f27358d3db64a81f395f81ec3f34810a9f74db37f9edca4cd
-
Filesize
223KB
MD569f2ccb12f81ec470df9d387b8c6bbb6
SHA12d8837824951e146eb9428b781936cfb605ce05b
SHA2560d2d950d7ac0b622b3d65a616fbb09875cd1c26d01eff31f07d000a61d6706b2
SHA512f93e3172b709cdb848a63a3d7909d0b43979960068e86045207d1884742e513e9613fabe1be402bcfe34fa46235e6a7d682bf9cb18fe5fbdb2dc404a7815e1e4
-
Filesize
477B
MD5ad8982eaa02c7ad4d7cdcbc248caa941
SHA14ccd8e038d73a5361d754c7598ed238fc040d16b
SHA256d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
SHA5125c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
-
Filesize
487KB
MD5eaa6b5ee297982a6a396354814006761
SHA1780bf9a61c080a335e8712c5544fcbf9c7bdcd72
SHA256d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee
SHA512ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999
-
Filesize
256KB
MD5938638d0da26178572066d3f62ddd15c
SHA19941160e7d06e97460aba020e29b42e52bec04e3
SHA2561a529633246ee8977411af4128738ee7389d8576e100f86fbf590a336e0f8d68
SHA512934c943250737c737e2f268632300bb923070518f4b7fa321c6d39392fa3cfce032d5a41d54de6ad40529b96e3699fe78251d98f79b102e38a70e49e7af5e1af
-
Filesize
192KB
MD5ba4a4b82dd8bd438959b8542d66161ad
SHA151d91e28ace38ea7d183498edd9031dabb6f18bb
SHA25682f87b955cbe426c3b6302bb2de938057166af6a0db02a3a191d17814fecefb8
SHA51272689ceba03390eaa0ca228d7885d15531fe57e9c4fdbe619bdd33777b3b79b7f828a81c11b60f16248cf64bff3086c41df04f25e7f13815fd2d3af971025e88