Overview
overview
8Static
static
3CS2ServerPicker_1.zip
windows7-x64
8CS2ServerPicker_1.zip
windows10-2004-x64
1CS2ServerPicker.exe
windows7-x64
8CS2ServerPicker.exe
windows10-2004-x64
8CS2ServerP...config
windows7-x64
3CS2ServerP...config
windows10-2004-x64
3CS2ServerPicker.pdb
windows7-x64
3CS2ServerPicker.pdb
windows10-2004-x64
3CS2ServerPicker.xml
windows7-x64
1CS2ServerPicker.xml
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1Newtonsoft.Json.xml
windows7-x64
1Newtonsoft.Json.xml
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 11:03
Static task
static1
Behavioral task
behavioral1
Sample
CS2ServerPicker_1.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
CS2ServerPicker_1.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
CS2ServerPicker.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
CS2ServerPicker.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
CS2ServerPicker.exe.config
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
CS2ServerPicker.exe.config
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
CS2ServerPicker.pdb
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
CS2ServerPicker.pdb
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
CS2ServerPicker.xml
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
CS2ServerPicker.xml
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
Newtonsoft.Json.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
Newtonsoft.Json.xml
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Newtonsoft.Json.xml
Resource
win10v2004-20240412-en
General
-
Target
CS2ServerPicker.exe.config
-
Size
1KB
-
MD5
4f2e4283d039d3ba0bb9cc1219efdf51
-
SHA1
1d31ab6731476d51c886035cebb75ea5ee845cfa
-
SHA256
12d57e10c3974005065473c57b38b36d284da7f827cd089e7cb6de10f4792e41
-
SHA512
54bb98adb42a812749ff5400c75aea6e644fac63662fd7716b0438449d71f3eeedbea28e6409f8e0bc8a367683c158c0f85250316a82d49d29425f95a1f32789
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2804 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2804 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2804 AcroRd32.exe 2804 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2804 2232 cmd.exe 29 PID 2232 wrote to memory of 2804 2232 cmd.exe 29 PID 2232 wrote to memory of 2804 2232 cmd.exe 29 PID 2232 wrote to memory of 2804 2232 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CS2ServerPicker.exe.config1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CS2ServerPicker.exe.config"2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5233bfe675d89493b2221aca5541a3d36
SHA15ad32b903af7d393b6c84246d8857a61357525e7
SHA2563cc234707e69ca87a32178f4ef13c744abe82c666310eb3eca958641033df310
SHA5124dbcbbcfb68f01effd5aa3f14922aeed32dd175eed91180467d0f832f7d8c271c7fb6d7fd9e057827f8ff98c3c718362a461b641acb441cb1cf248835fc4c538