e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c

Analysis

max time kernel
1792s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12/04/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Dolphin.exe
Size

14.9MB
MD5

9660ec7cddf093a1807cb25fe0946b8e
SHA1

5986661c62d689380476db238d7c18fa37d1b616
SHA256

19d5c382204d7e40a764e116967aec610f502b9be60b9d3b095073827aa93c66
SHA512

5213c828d4f0742c3cde59ceea7b111a1402779602f09fa5e898083b07f2860bb33119f97741bc049fefc0cd745879d22a12dc37ece8e0dd8b308dcc84079755
SSDEEP

196608:HgfH5UoUTKklTNrDatogipuoBvfU2+YOcfyOGXutM8/:A/5UomlTNMogipuoBvfU2bOevGeP/

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	bcastdvr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	bcastdvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bcastdvr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1988	Dolphin.exe
1988	Dolphin.exe
1988	Dolphin.exe
1988	Dolphin.exe

C:\Users\Admin\AppData\Local\Temp\Dolphin.exe
"C:\Users\Admin\AppData\Local\Temp\Dolphin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1988

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 0000000000050218 /startuptips
1⤵
PID:808

C:\Windows\System32\bcastdvr.exe
"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
0d57e4acb0103b89b4b32c699875b72a

SHA1
3c291537ebaa57822d4c1e090cc53981e539c3b3

SHA256
39d03bfd01d631dd44f7e5413e4e61d26334b0699be05c84b24dec04ec0fec41

SHA512
6c40640207fca53113fbd5c678c7f1b250866273c9d2421d892a4891d0cb9e81d44ec51326f7f9d9f3a28268180ab7fadd28459cf57f836362873714c3423f23

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
a7f7f7cf37a01ad773541d83563e7654

SHA1
0cefcfc95a6d699f75551e00ae18a20e4ec0a233

SHA256
0b8bc890b8b0b2e41a2a00b778aae551163327dff112611d19b714bc3c0fa87e

SHA512
e724f9fc08ec34721aca31df521abe441cdd1fec88cc83884c7fe622df35b51a54e7574dc943220681b4e437c8e1932a45330896210c70b43ca7273dd60cf911

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Wii\shared2\sys\SYSCONF

Filesize
16KB

MD5
9473c879a5e51040e7a202b4538773a7

SHA1
3256c026284a24fb99d2ec1558d95db3b5dcc2e9

SHA256
a8ec1ec377ee3a3c93a27f74dadf9edf95112ce167fc23d1abdbeb4fa15eb179

SHA512
139dbb6648a1c8b7e5224e52ca8f8093f069b7d5f83e2b84099688b927eb77cb8445bc46f9da98ce56d3b883bfe8e38905b5e252c87a5295a334fc8b6890bff3

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/1988-49-0x000000006B600000-0x000000006B69F000-memory.dmp

Filesize
636KB

Download