Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
05/03/2024, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
Valorant Triggerbot (1).rar
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
Valorant Triggerbot/config.json
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
Valorant Triggerbot/main.exe
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
Valorant Triggerbot/main.py
Resource
win10-20240221-en
General
-
Target
Valorant Triggerbot/main.py
-
Size
3KB
-
MD5
6a7506e226903d8f9132c6ad97088d26
-
SHA1
399a1e88f08467b19cd52b367efcb6c717552af3
-
SHA256
2ec9745da929ba830dd3539b7c1aa51847b1d9393401ce07361e3622c1908d3f
-
SHA512
c1b26114e8cc509f505f6888c7883cec6c8f55a219594d8163b5ae43ba3728d2e7102eaf726ec9ccd3ef08c5fcabe1b570af2304e94d043ea0d64a4dc9ea5a51
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 436 OpenWith.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe 436 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Valorant Triggerbot\main.py"1⤵
- Modifies registry class
PID:3980
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:436