24d0fbed27eb3ac262a56211591e61b9ddb2ce45d9b9f34be78dc75f69e5df0a

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GameStealer.py
Size

390KB
MD5

4141f773c15ba4be83c77ef77b76ff90
SHA1

63999b309981efb2e7b9c0cb9d700ff064b28974
SHA256

73934fab0bde13926390305bc8b41f2489c958cd525328e61a90df7c555123a1
SHA512

c7b02ee1c99df42acef22530ee70556cb89e2ff01e2a35e6dfde8dc4c19a4922e375565a763e322067a47157722457da72d0a786df3df79242d2f5c14352e8c7
SSDEEP

768:eIa8fvV0Ny9CrXYQlYPzNoUdNWX9HDNyGcJPQUYcFrwgtuLb4uycKvm39vKOpuSx:aM4yC1CPzNstHvULxGHlKH0Wjtq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4760 OpenWith.exe

pid	process
4760	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GameStealer.py
1⤵
- Modifies registry class
PID:4736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4760

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads