Overview
overview
9Static
static
7Pain Exist....3.dll
windows7-x64
1Pain Exist....3.dll
windows10-2004-x64
1Pain Exist...ox.dll
windows7-x64
1Pain Exist...ox.dll
windows10-2004-x64
1Pain Exist...In.dll
windows7-x64
1Pain Exist...In.dll
windows10-2004-x64
1Pain Exist...rk.dll
windows7-x64
1Pain Exist...rk.dll
windows10-2004-x64
1Pain Exist....9.exe
windows7-x64
9Pain Exist....9.exe
windows10-2004-x64
9Pain Exist...le.dll
windows7-x64
7Pain Exist...le.dll
windows10-2004-x64
7Pain Exist...ET.dll
windows7-x64
1Pain Exist...ET.dll
windows10-2004-x64
1Pain Exist...32.dll
windows7-x64
3Pain Exist...32.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 10:42
Behavioral task
behavioral1
Sample
Pain Exist 3.9/Bunifu_UI_v1.5.3.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Pain Exist 3.9/Bunifu_UI_v1.5.3.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Pain Exist 3.9/FastColoredTextBox.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Pain Exist 3.9/FastColoredTextBox.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
Pain Exist 3.9/LogIn.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Pain Exist 3.9/LogIn.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
Pain Exist 3.9/MetroFramework.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
Pain Exist 3.9/MetroFramework.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
Pain Exist 3.9/Pain Exist 3.9.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Pain Exist 3.9/Pain Exist 3.9.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Pain Exist 3.9/PainModule.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
Pain Exist 3.9/PainModule.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
Pain Exist 3.9/ScintillaNET.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Pain Exist 3.9/ScintillaNET.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
Pain Exist 3.9/discord-rpc-w32.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Pain Exist 3.9/discord-rpc-w32.dll
Resource
win10v2004-20240419-en
General
-
Target
Pain Exist 3.9/Pain Exist 3.9.exe
-
Size
5.0MB
-
MD5
476ad1e42f46dc9fa19d292c86912339
-
SHA1
9b56b06e658e09db429ffe0b277ade58951195df
-
SHA256
8ce7960ddd89997626bf08a9f105509921aa38901cb0c113ae37a9e9718ef46b
-
SHA512
ae747c67de618fb54be1f2a53eac0c1d820cd540f959b7925e2ed49e9134e3bd0902b39816cdb4029a5671d0211244590d975048edca1638a45a09e572ad22fa
-
SSDEEP
98304:+2aAJLs/Zb7yRZmkew0jLLqUK1OlXKNH0bwt9stD+6f:8AJLs/ZPyLmxvLqU3XKBe
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
Pain Exist 3.9.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions Pain Exist 3.9.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
Pain Exist 3.9.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools Pain Exist 3.9.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Pain Exist 3.9.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Pain Exist 3.9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Pain Exist 3.9.exe -
Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral9/memory/2940-1-0x0000000005BD0000-0x0000000006284000-memory.dmp agile_net behavioral9/memory/2940-13-0x0000000005BD0000-0x0000000006276000-memory.dmp agile_net behavioral9/memory/2940-15-0x0000000005BD0000-0x0000000006276000-memory.dmp agile_net behavioral9/memory/2940-11-0x0000000005BD0000-0x0000000006276000-memory.dmp agile_net -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Pain Exist 3.9.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Pain Exist 3.9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Pain Exist 3.9.exe -
Modifies registry class 9 IoCs
Processes:
Pain Exist 3.9.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\discord-546107155254870045\DefaultIcon Pain Exist 3.9.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\discord-546107155254870045\shell\open\command Pain Exist 3.9.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\discord-546107155254870045\shell\open Pain Exist 3.9.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\discord-546107155254870045\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Pain Exist 3.9\\Pain Exist 3.9.exe" Pain Exist 3.9.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\discord-546107155254870045\ = "URL:Run game 546107155254870045 protocol" Pain Exist 3.9.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\discord-546107155254870045\URL Protocol Pain Exist 3.9.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\discord-546107155254870045\shell Pain Exist 3.9.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\discord-546107155254870045 Pain Exist 3.9.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\discord-546107155254870045\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Pain Exist 3.9\\Pain Exist 3.9.exe" Pain Exist 3.9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Pain Exist 3.9.exepid process 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe 2940 Pain Exist 3.9.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Pain Exist 3.9.exedescription pid process Token: 33 2940 Pain Exist 3.9.exe Token: SeIncBasePriorityPrivilege 2940 Pain Exist 3.9.exe Token: SeDebugPrivilege 2940 Pain Exist 3.9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pain Exist 3.9\Pain Exist 3.9.exe"C:\Users\Admin\AppData\Local\Temp\Pain Exist 3.9\Pain Exist 3.9.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2940-0-0x00000000741DE000-0x00000000741DF000-memory.dmpFilesize
4KB
-
memory/2940-2-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-1-0x0000000005BD0000-0x0000000006284000-memory.dmpFilesize
6.7MB
-
memory/2940-3-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-10-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-13-0x0000000005BD0000-0x0000000006276000-memory.dmpFilesize
6.6MB
-
memory/2940-15-0x0000000005BD0000-0x0000000006276000-memory.dmpFilesize
6.6MB
-
memory/2940-11-0x0000000005BD0000-0x0000000006276000-memory.dmpFilesize
6.6MB
-
memory/2940-17-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-18-0x0000000005A80000-0x0000000005B5E000-memory.dmpFilesize
888KB
-
memory/2940-19-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-20-0x00000000063B0000-0x000000000640A000-memory.dmpFilesize
360KB
-
memory/2940-21-0x0000000006790000-0x00000000067EC000-memory.dmpFilesize
368KB
-
memory/2940-22-0x0000000002940000-0x000000000295C000-memory.dmpFilesize
112KB
-
memory/2940-23-0x00000000067F0000-0x0000000006848000-memory.dmpFilesize
352KB
-
memory/2940-24-0x0000000000400000-0x0000000000991000-memory.dmpFilesize
5.6MB
-
memory/2940-25-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-26-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-27-0x00000000741DE000-0x00000000741DF000-memory.dmpFilesize
4KB
-
memory/2940-28-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-29-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-30-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-31-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-33-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-34-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-35-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-36-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-37-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-39-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-40-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-42-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB
-
memory/2940-44-0x00000000741D0000-0x00000000748BE000-memory.dmpFilesize
6.9MB