Overview
overview
10Static
static
3RAM.zip
windows10-1703-x64
1GameAssembly.dll
windows10-1703-x64
1RAM.exe
windows10-1703-x64
10RAM_Data/P...ss.dll
windows10-1703-x64
1RAM_Data/P...ed.dll
windows10-1703-x64
1RAM_Data/R...ources
windows10-1703-x64
1RAM_Data/R..._extra
windows10-1703-x64
1RAM_Data/R...s.json
windows10-1703-x64
3RAM_Data/S...s.json
windows10-1703-x64
3RAM_Data/app.info
windows10-1703-x64
3RAM_Data/boot.config
windows10-1703-x64
3RAM_Data/g...nagers
windows10-1703-x64
1RAM_Data/g...assets
windows10-1703-x64
3RAM_Data/g...s.ress
windows10-1703-x64
3RAM_Data/i...ta.dat
windows10-1703-x64
3RAM_Data/i...es.dat
windows10-1703-x64
3RAM_Data/level0
windows10-1703-x64
1RAM_Data/s...assets
windows10-1703-x64
3RAM_Data/s...s.ress
windows10-1703-x64
3UnityCrash...64.exe
windows10-1703-x64
1UnityPlayer.dll
windows10-1703-x64
1baselib.dll
windows10-1703-x64
1Resubmissions
Analysis
-
max time kernel
74s -
max time network
190s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
13-04-2024 23:38
Static task
static1
Behavioral task
behavioral1
Sample
RAM.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
GameAssembly.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
RAM.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
RAM_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
RAM_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
RAM_Data/Resources/unity default resources
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
RAM_Data/Resources/unity_builtin_extra
Resource
win10-20240319-en
Behavioral task
behavioral8
Sample
RAM_Data/RuntimeInitializeOnLoads.json
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
RAM_Data/ScriptingAssemblies.json
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
RAM_Data/app.info
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
RAM_Data/boot.config
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
RAM_Data/globalgamemanagers
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
RAM_Data/globalgamemanagers.assets
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
RAM_Data/globalgamemanagers.assets.ress
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
RAM_Data/il2cpp_data/Metadata/global-metadata.dat
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
RAM_Data/il2cpp_data/Resources/mscorlib.dll-resources.dat
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
RAM_Data/level0
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
RAM_Data/sharedassets0.assets
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
RAM_Data/sharedassets0.assets.ress
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
UnityCrashHandler64.exe
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
UnityPlayer.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
baselib.dll
Resource
win10-20240404-en
General
-
Target
RAM_Data/sharedassets0.assets.ress
-
Size
65.7MB
-
MD5
764dad76653d445cf25cd0dfacd20c62
-
SHA1
966449f7ecfd0e2926559af3d1769886999a5665
-
SHA256
40c23970a3ae8b4ce50447b2bfa6061f3ab676788c13ec47c6fa07bbdc5cecfa
-
SHA512
46a3a94ae20902f41ffb1b5bf97e1e6ffd17cc714ed10a3a192ddf3af41a901bed6a7230bb8ef24e073946c98a72ccc4936efe4ac81cf1cd32acb189717be4d4
-
SSDEEP
98304:S1yfOke1432HwWjoHq4DGCBwqAfiidCKJcFGgaD0Yu05KCahZdinCjfuN:TWrgYRjoH/3Pm/KGgaD0Yu05zwZUnCz
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid Process 4736 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\RAM_Data\sharedassets0.assets.ress1⤵
- Modifies registry class
PID:3672
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4736