Analysis
-
max time kernel
143s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
17/04/2024, 19:50
General
-
Target
[FreeTP.Org]Borderlands-3-Multiplayer-Fix-Online-LAN.exe
-
Size
1.3MB
-
MD5
a5c41e111db7548895c5ea16f7436954
-
SHA1
e3f24bedb3069f9609390c6134e7135e3a1f1b9b
-
SHA256
9e8e0209026eef6a93f9dcf563d0dd257a3b5091c8ab2d7d6c54076a7b9a327f
-
SHA512
b7edc5cfb31c1ecd919bd2b77cb08af6f905cf22b5281a9325e53f77bc578dd18cb4aa14b380eb53257f180eb25792deafbc54bc6dd65b95d8e8ceb27b01500e
-
SSDEEP
24576:+MjhP0Km1aFnFhlMxb8jlJrh+EoPuMvI138ab5dayy5:9h058TlMxb47h+DNI75X2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Borderlands-3-Multiplayer-Fix-Online-LAN.exe"C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Borderlands-3-Multiplayer-Fix-Online-LAN.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H9MCQ.tmp\[FreeTP.Org]Borderlands-3-Multiplayer-Fix-Online-LAN.tmp"C:\Users\Admin\AppData\Local\Temp\is-H9MCQ.tmp\[FreeTP.Org]Borderlands-3-Multiplayer-Fix-Online-LAN.tmp" /SL5="$80236,813944,190464,C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Borderlands-3-Multiplayer-Fix-Online-LAN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5abd301b0263b0e0cebdd71e4855ac7d3
SHA11e8480c3f3b47a5daa7cb1183b6a7a49998cda6e
SHA256aff003e75bbf410ed2f7ca8728afe01ab4a517536647ad20109d00c4adf570d5
SHA512b5abb188bd23d7fc2e3253a5639cc3eba6d21774dba55b43395cf84ddb49fe707ad54dc0a7f157e6b0804c1662d9c4cb4bef2787aafb194ea73fbebd1a63bb6b
-
Filesize
62KB
MD5b91658597f15d7f689c86f5a2e7824bd
SHA100da609aa0b39140b767a3bc2644433d64edbd71
SHA256b3cda6ab45ad5aa6a0a5f700d2c8987b3c1c1ebda63165d9bd5a566b24dcbd84
SHA51200b287fb14b947edf4b16d52243e9a992595d8894e83d8590473103d1b54a4670b323db13c4f78234617c44f905baf517e68fcceaad313f3ea7cd44cf036daea
-
Filesize
12KB
MD551af4120d6d22b1126cc87a5143740ef
SHA11cb4e91e765537a72c9628056d29fbd6a7ce515c
SHA256c74fed62141f7e666379a0b00d5b39c86975332cf08151cbe8cab88eff2c393c
SHA5122595be954684ca34bc9284337524a5191c72fbea46b59555a5113ed8404a1e7ab6c2aa0f5a975f832cccdd8934ff1140c679ecd940f31cc14b4c3a362a225cbc
-
Filesize
1.5MB
MD517fac68c3018078e9bedc9d58d02423b
SHA1e434edc315f792d2835e8d507218890df3eea64c
SHA256c87bd5d9698eb981ee384baa08305e7b94769e0cf3c1bbc97d11aab096013417
SHA512bd0f62b2e4e828d2ddda98bdb337fbfc3b6c859781c499deec3130b3922fc0e71d695418881fab5bafb8da44dce6b10141f873fb94fa579d1a847468f4fb8d7f
-
Filesize
32KB
MD5295832fa6400cb3407cfe84b06785531
SHA17068910c2e0ea7f4535c770517e29d9c2d2ee77b
SHA25613e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784
SHA51250516f9761efd14641f65bd773cfdd50c4ab0de977e094ba9227796dc319d9330321c7914243fc7dc04b5716752395f8dac8ccdfdb98ba7e5f5c1172408ce57b
-
Filesize
76KB
MD52e35d2894df3b691dbd8e0d4f4c84efc
SHA1d0fc14963e397d185e9f2d7dea1d07bc6308d5b9
SHA256869079ba362cbc560d673db290248ec2aa075a74f22a82d90621f1118f8e1c4d
SHA51229ba662ab2e77aef0547ff76213a1b6ef52be27a446923790a27cf8b69377621048387dbb9f22001b6d15837dddada84c7350614ec9622258319658822705f90
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
1.5MB
-
Filesize
1024KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
52KB
-
Filesize
84KB
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
