Overview

overview

8

Static

static

3

game.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    game.exe

  • Size

    9.5MB

  • Sample

    240511-ks6rbacg28

  • MD5

    a3f779e15e40e6ceafb62093600431da

  • SHA1

    b6e8a2114ae00e16f976859679a67c576beeaad1

  • SHA256

    2e24c77c1e27a77e8312a9961b0dffb937decf175cf71e077fc2f4b31cec7e7f

  • SHA512

    60463509850ecffdd941b24f98d19b74db976632bbf9ff07dbe0e00d528a10589ee978ad3cf395edeaf7efcd834568cfeff1dfc42d32c29b4871d7c1e84243fc

  • SSDEEP

    98304:xE5p/yYPMhNSn53O50TL523tEEGSF8poju:wlyYPi8M50TLQ3+Eioju

Score
8/10
executionpersistencespywarestealer

Malware Config

Targets

    • Target

      game.exe

    • Size

      9.5MB

    • MD5

      a3f779e15e40e6ceafb62093600431da

    • SHA1

      b6e8a2114ae00e16f976859679a67c576beeaad1

    • SHA256

      2e24c77c1e27a77e8312a9961b0dffb937decf175cf71e077fc2f4b31cec7e7f

    • SHA512

      60463509850ecffdd941b24f98d19b74db976632bbf9ff07dbe0e00d528a10589ee978ad3cf395edeaf7efcd834568cfeff1dfc42d32c29b4871d7c1e84243fc

    • SSDEEP

      98304:xE5p/yYPMhNSn53O50TL523tEEGSF8poju:wlyYPi8M50TLQ3+Eioju

    Score
    8/10
    executionpersistencespywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks