Analysis
-
max time kernel
15s -
max time network
24s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2024 19:58
Static task
static1
Behavioral task
behavioral1
Sample
GamePingBooster/Setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
GamePingBooster/Setup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
GamePingBooster/Setup.exe
Resource
win11-20240412-en
General
-
Target
GamePingBooster/Setup.exe
-
Size
493KB
-
MD5
979119c0ff7fe623c1115a1a965507d2
-
SHA1
26bda6aa1aef1243aae1da88e986af6c8e990fd1
-
SHA256
84b587ec425746bfa985048f3c189fd96f485759e5cc78d90c8287764b08ae17
-
SHA512
d716badbfd48216a51b0bc0a1b49ce7011d047c8609a2f0cdd25273e4c72222704cdd6071bce1fdc9ba46b042206525dd0fba0e76306ac44c996c4874986da3d
-
SSDEEP
12288:Wx36Rr9pdHMJtOmz448EY3lfEX9ZNNp4bZu32pteE:WR67HHMbrE4BYWqZ06A
Malware Config
Extracted
lumma
https://bordersoarmanusjuw.shop/api
https://entitlementappwo.shop/api
https://economicscreateojsu.shop/api
https://pushjellysingeywus.shop/api
https://absentconvicsjawun.shop/api
https://suitcaseacanehalk.shop/api
https://mealplayerpreceodsju.shop/api
https://wifeplasterbakewis.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 2424 set thread context of 4048 2424 Setup.exe RegAsm.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Setup.exedescription pid process target process PID 2424 wrote to memory of 4048 2424 Setup.exe RegAsm.exe PID 2424 wrote to memory of 4048 2424 Setup.exe RegAsm.exe PID 2424 wrote to memory of 4048 2424 Setup.exe RegAsm.exe PID 2424 wrote to memory of 4048 2424 Setup.exe RegAsm.exe PID 2424 wrote to memory of 4048 2424 Setup.exe RegAsm.exe PID 2424 wrote to memory of 4048 2424 Setup.exe RegAsm.exe PID 2424 wrote to memory of 4048 2424 Setup.exe RegAsm.exe PID 2424 wrote to memory of 4048 2424 Setup.exe RegAsm.exe PID 2424 wrote to memory of 4048 2424 Setup.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GamePingBooster\Setup.exe"C:\Users\Admin\AppData\Local\Temp\GamePingBooster\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4048