Overview

overview

7

Static

static

3

Rome Total...un.exe

windows7-x64

7

Rome Total...un.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-05-2024 19:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Rome Total War Alexander V1.91 Trainer +3 MrAntiFun.exe

  • Size

    4.5MB

  • MD5

    44c39c7aef714f574afc9fd6923fa368

  • SHA1

    417c036a782baf644de4d672b8b9bf70b844e20d

  • SHA256

    65f0c1f1dfdf24fe90dcd4d1f97d66d7fdb35331d27e7a8b61061cc1e90dd5b6

  • SHA512

    a09cfe0eaf84857011bcde6f1d1a5d0c1852dddab72fe979404f2090439a4e470f51604ad45e862ca7a965959474b1c50029419833572e0c6d3bbf69f6bc3111

  • SSDEEP

    98304:LH0L7VtmWTy5OwsyOBqFY+pWUkU0rLm8qeuPcXi2ub:j0/5Ty5PXtNWpfyZaiBb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 45 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rome Total War Alexander V1.91 Trainer +3 MrAntiFun.exe
    "C:\Users\Admin\AppData\Local\Temp\Rome Total War Alexander V1.91 Trainer +3 MrAntiFun.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\Rome Total War Alexander V1.91 Trainer +3 MrAntiFun.exe
      "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\Rome Total War Alexander V1.91 Trainer +3 MrAntiFun.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\extracted\Rome Total War Alexander V1.91 Trainer +3 MrAntiFun.exe
        "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\extracted\Rome Total War Alexander V1.91 Trainer +3 MrAntiFun.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:432
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4080,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
    1⤵
      PID:552

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\CET_Archive.dat
      Filesize

      4.2MB

      MD5

      152cea7a8d92568a6d287f3e8755389b

      SHA1

      327ca2926246dbbca15af44e3ea557dbe92ccafa

      SHA256

      77313b886a7ea0530a052b32d1496cfdc920d98cfd4967a76ddb419c848f181c

      SHA512

      0cdf34f3aebef8f97338cb2124f1d66c5c0a2277b67e01e1b676255fa27d14d1e9973e236db945291486a75363c1ad74b4253597e6f460194f5cc502691264f2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\Rome Total War Alexander V1.91 Trainer +3 MrAntiFun.exe
      Filesize

      193KB

      MD5

      6852660b8cbb67ee3f1e31bf2f1e0afd

      SHA1

      c1b790e062f3a13d3e2f90c58e92ded585abbe3b

      SHA256

      cd86234cf14dfc0e66ae9e575326fd0cf74723a5a60337f7079c0540b6da5c8b

      SHA512

      5722ebf6bef799721464094c6d6a81931bf8f78bdd1fbe12b153cf7b0e4e9e7307fa7a01e0cc16ce885c20c3a0a3cc95d6a7d86413f0c61cca3450fa565dd6a8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\extracted\CET_TRAINER.CETRAINER
      Filesize

      509KB

      MD5

      2658d54c171756539a9691d1e1341115

      SHA1

      c8d98cdf68316cae324a4cc409683a427fcd9d23

      SHA256

      98f7dc8f25e6cdb6aeb484f8280bdf6e332c575e6509952eb70b244e0a8de42d

      SHA512

      74ee3aacb7095c1b448e2c7e73af5da5e28cc19f714f17fa72b1cdd0878ac031321c10e08f2f676e448944ea0daa6043cf8f5df8346842ec1ef0c005143cfe1b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\extracted\Rome Total War Alexander V1.91 Trainer +3 MrAntiFun.exe
      Filesize

      7.6MB

      MD5

      7fd341bc6d65a263627def33b1657a1a

      SHA1

      8e3978836fddb530e14126dab75ac58289cb2060

      SHA256

      fb416f9301c9528ee3fed2a5af3b209c0a7f2fa710198f9c07ab8ee96a4cfa96

      SHA512

      a34ddcbb7ff014127087f83f0150b76de0bb152d6817434a4ab5740c066938c58f774954f05792632edfda2dab888dca997bc8ceb167ff259fe3d26c34c7d5b6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\extracted\defines.lua
      Filesize

      5KB

      MD5

      1dc41a0a351e745085fcc98a3933d91f

      SHA1

      bf1e7d333e6d7b3d4bfe5cdcada19af1931dbe15

      SHA256

      a2e02dd32f0245ff31190288b368b3efbbe7c48a95dd22c321231c2f46597d9b

      SHA512

      76f171411d028e72613859332f381f8f26e85d1844c143a8888e4937ca72d7b38ffe66ce617eee5e8155ba034dcc559a9417b5def056bb74227b9bae392d1440

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\extracted\lua53-32.dll
      Filesize

      491KB

      MD5

      c8f47a0e750e07d86a47b3296fb59a97

      SHA1

      1f894c9aa88dd2448e50ab5e7277cd4b4c629c6d

      SHA256

      dcfd91f21dee9e70179337a85d21b3ca925f1a6c21de9576aa5219732b7c7a86

      SHA512

      e154a097e8e174a47fea76c96d1c27d93cf9bfbdc47eeef56486cc3d2e661649a1d7da5cfe0ce220ea172f4646ab4eecbd2e1594011d0a8ca1eb416cd84b8b2a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETE09C.tmp\extracted\win32\dbghelp.dll
      Filesize

      1.2MB

      MD5

      9139604740814e53298a5e8428ba29d7

      SHA1

      c7bf8947e9276a311c4807ea4a57b504f95703c9

      SHA256

      150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f

      SHA512

      0b99259e9c0ee566d55cc53c4a7eabf025ed95973edc80ded594023a33f8273cd5d3f3053993f771f9db8a9d234e988cba73845c19ddc6e629e15a243c54cd5d

      Download Submit

    • memory/432-20-0x0000000004730000-0x0000000004731000-memory.dmp

      Filesize

      4KB

      Download

    • memory/432-22-0x0000000004730000-0x0000000004770000-memory.dmp

      Filesize

      256KB

      Download

    • memory/432-23-0x0000000004730000-0x0000000004770000-memory.dmp

      Filesize

      256KB

      Download