Overview

overview

10

Static

static

1

MuMuInstal...87.exe

windows7-x64

10

MuMuInstal...87.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2024, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MuMuInstaller_3.1.6.0_yx-gl-codex_all_1709777287.exe
  • Size 5.3MB
  • Sample240331-rxyptseb35
  • SHA256 baa175b6fa6ee27992d80995f9eae285f3a3eceb35b655c0c5a5f58b7ac748dc
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
persistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 7 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 12 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MuMuInstaller_3.1.6.0_yx-gl-codex_all_1709777287.exe
    "C:\Users\Admin\AppData\Local\Temp\MuMuInstaller_3.1.6.0_yx-gl-codex_all_1709777287.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Users\Admin\AppData\Local\Temp\7z7540677C\nemu-downloader.exe
      C:\Users\Admin\AppData\Local\Temp\7z7540677C\nemu-downloader.exe
      2⤵
      • Enumerates connected drives
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:852
      • C:\Users\Admin\AppData\Local\Temp\7z7540677C\ColaBoxChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z7540677C\ColaBoxChecker.exe" checker /baseboard
        3⤵
        • Executes dropped EXE
        PID:4580
      • C:\Users\Admin\AppData\Local\Temp\7z7540677C\HyperVChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z7540677C\HyperVChecker.exe"
        3⤵
        • Executes dropped EXE
        PID:4764
      • C:\Users\Admin\AppData\Local\Temp\7z7540677C\HyperVChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z7540677C\HyperVChecker.exe"
        3⤵
        • Executes dropped EXE
        PID:2344
      • C:\Users\Admin\AppData\Local\Temp\7z7540677C\HyperVChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z7540677C\HyperVChecker.exe"
        3⤵
        • Executes dropped EXE
        PID:1796
      • C:\Users\Admin\AppData\Local\Temp\7z7540677C\MuMuDownloader.exe
        "C:\Users\Admin\AppData\Local\Temp\7z7540677C\MuMuDownloader.exe" --log="C:\Users\Admin\AppData\Local\Temp\nemu-downloader-aria.log" --log-level=notice --check-certificate=false --enable-rpc=true --rpc-listen-port=49894 --continue --max-concurrent-downloads=10 --max-connection-per-server=5 --async-dns=false --file-allocation=prealloc --enable-mmap=true --connect-timeout=5 --rpc-max-request-size=1024M --stop-with-process=852
        3⤵
        • Executes dropped EXE
        PID:4492
      • C:\Users\Admin\AppData\Local\Temp\MuMuNG-setup-V3.8.3.2696-overseas-0221213808.exe
        "C:\Users\Admin\AppData\Local\Temp\MuMuNG-setup-V3.8.3.2696-overseas-0221213808.exe" /S /auto_start=false /fchannel=yx-gl-codex /D=C:\Program Files\Netease\MuMuPlayerGlobal-12.0
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Registers COM server for autorun
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc.exe" query MuMuVMMDrv
          4⤵
          • Launches sc.exe
          PID:7604
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2892

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          comregister.cmd
          • Path C:\Program Files\Netease\MuMuPlayerGlobal-12.0\temp\hypervisor\comregister.cmd
          • Size 7KB
          • SHA256 dcddc8c892e73bdb7e3a05d3d7e5ff8cf193ec1e27497a3c0bf5641dc542ccbc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ColaBoxChecker.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z7540677C\ColaBoxChecker.exe
          • Size 4.0MB
          • SHA256 1373c5d006a5dbcd9b86cfff9a37616f1245d1333c4adcefc7cd18926b98d752
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          HyperVChecker.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z7540677C\HyperVChecker.exe
          • Size 117KB
          • SHA256 9ff467bc5a1c377102d25da9fa9c24dcc4375f456510f71584f0714fdfb2af39
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MuMuDownloader.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z7540677C\MuMuDownloader.exe
          • Size 5.7MB
          • SHA256 2f980c56d81f42ba47dc871a04406976dc490ded522131ce9a2e35c40ca8616e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          baseboard
          • Path C:\Users\Admin\AppData\Local\Temp\7z7540677C\baseboard
          • Size 115B
          • SHA256 69ec5e317149044e3ec5852146317984d134d785f0ecfd05a52f09a7f5bd16bc
          • MD5 SHA1 SHA512
          Submit Download

          config.ini
          • Path C:\Users\Admin\AppData\Local\Temp\7z7540677C\config.ini
          • Size 342B
          • SHA256 536276708fd9e141dc5036a7feb791a2467c667bb16d7ce90bf2917a68a772a2
          • MD5 SHA1 SHA512
          Submit Download

          nemu-downloader.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z7540677C\nemu-downloader.exe
          • Size 3.2MB
          • SHA256 7662f1e4e1b4a52cce2fb8c57ffdd4ec8654f3bd1a830814845e75fdcd3f1735
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          skin.zip
          • Path C:\Users\Admin\AppData\Local\Temp\7z7540677C\skin.zip
          • Size 509KB
          • SHA256 45a97dba97f3613ec8f357d9a36fe336c2795ead0f32081856b9b2dad4620ce1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MuMuNG-setup-V3.8.3.2696-overseas-0221213808.exe
          • Path C:\Users\Admin\AppData\Local\Temp\MuMuNG-setup-V3.8.3.2696-overseas-0221213808.exe
          • Size 423.8MB
          • SHA256 652ac4a7a8fc71d502676a6dc5be3ad5cc89b390616d9e94ec2d4acbdfd3392b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MuMuNG-setup-V3.8.3.2696-overseas-0221213808.exe
          • Path C:\Users\Admin\AppData\Local\Temp\MuMuNG-setup-V3.8.3.2696-overseas-0221213808.exe
          • Size 295.3MB
          • SHA256 ad2321612a7c819dc88ac761eee0e86e11427781b5bcdd557a1965432a650eaa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          AccessControl.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh6096.tmp\AccessControl.dll
          • Size 23KB
          • SHA256 1b4d25f2f544f520c20493ee1e9ac7b3043aab88e4ff87953390d357de4c2096
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          LogEx.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh6096.tmp\LogEx.dll
          • Size 52KB
          • SHA256 cf7b45a69a13551db95dcdefc8bfdd4128e1c1db67198347b43469b69c36b844
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh6096.tmp\System.dll
          • Size 12KB
          • SHA256 b6298637fea88a44e4de3f6b7fe254fb73857c08f1dcd8bd1af6f9eb5e6e7e3c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          UAC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh6096.tmp\UAC.dll
          • Size 22KB
          • SHA256 fa3bb333f615689691ff98527dc3341e3b8ffee4bf97c6128820bf0d303930e7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          UserInfo.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh6096.tmp\UserInfo.dll
          • Size 3KB
          • SHA256 d6fae2e57c84b25b73fe942fb7ba725158b21ec81c9d989845b64ba1ee337c27
          • MD5 SHA1 SHA512
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh6096.tmp\nsProcess.dll
          • Size 12KB
          • SHA256 44c14f1edfe7deef518264675e3e4edb6991d5ea0d50f0f6b18a819dc31bbcba
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/4492-82-0x00000000004C0000-0x0000000000A75000-memory.dmp
          Download

          memory/4492-80-0x00000000004C0000-0x0000000000A75000-memory.dmp
          Download

          memory/4492-76-0x00000000004C0000-0x0000000000A75000-memory.dmp
          Download