Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 14:53
Behavioral task
behavioral1
Sample
Decompiler.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Decompiler.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
GameStealer.py
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
GameStealer.py
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
Saveinstance.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Saveinstance.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Select Your game.py
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Select Your game.py
Resource
win10v2004-20240412-en
General
-
Target
Decompiler.exe
-
Size
20.7MB
-
MD5
b40a6bcc22defbebb77ea2983a7a4df2
-
SHA1
f6425b5d296383349ae2b35613911d64774b5336
-
SHA256
1a29391708c03be3cc6fe8f5be11415c34c12fec77c72258322f3fdeef35b08e
-
SHA512
581ebdb5329d1049484764baea16e165c17adba3f18096d73a17b15e88fdad527931ff24382a9ea120e8735eb8d61c3781e5d011e65b29261ca5fbcba380ccac
-
SSDEEP
393216:AqPnLFXlrfh2Jp5qC3njkVQ8DOETgsvfGF2Kgp6HgPtvE4sk2Xnqmm:BPLFXNfh50sQhEqQD6TK
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Decompiler.exepid process 2772 Decompiler.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI19362\python310.dll upx behavioral1/memory/2772-130-0x000007FEF5D00000-0x000007FEF616E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Decompiler.exedescription pid process target process PID 1936 wrote to memory of 2772 1936 Decompiler.exe Decompiler.exe PID 1936 wrote to memory of 2772 1936 Decompiler.exe Decompiler.exe PID 1936 wrote to memory of 2772 1936 Decompiler.exe Decompiler.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI19362\python310.dllFilesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
C:\Users\Admin\AppData\Local\Temp\_MEI19362\setuptools-65.5.0.dist-info\INSTALLERFilesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
memory/2772-130-0x000007FEF5D00000-0x000007FEF616E000-memory.dmpFilesize
4.4MB