Overview
overview
7Static
static
3Mad.Father...20.zip
windows11-21h2-x64
1Mad.Father...ig.exe
windows11-21h2-x64
1Mad.Father...a.wolf
windows11-21h2-x64
3Mad.Father...me.exe
windows11-21h2-x64
1Mad.Father...me.ini
windows11-21h2-x64
3Mad.Father...ER.exe
windows11-21h2-x64
6Mad.Father...64.exe
windows11-21h2-x64
6Mad.Father...mu.ini
windows11-21h2-x64
3Mad.Father...mu.txt
windows11-21h2-x64
3Mad.Father...ry.bin
windows11-21h2-x64
3Mad.Father...ma.bin
windows11-21h2-x64
3Mad.Father...ms.bin
windows11-21h2-x64
3Mad.Father...ms.bin
windows11-21h2-x64
3Mad.Father...me.txt
windows11-21h2-x64
3Mad.Father...ar.png
windows11-21h2-x64
3Mad.Father...ll.ini
windows11-21h2-x64
3Mad.Father...ay.ini
windows11-21h2-x64
3Mad.Father...ge.ini
windows11-21h2-x64
3Mad.Father...ge.wav
windows11-21h2-x64
6Mad.Father...ay.dll
windows11-21h2-x64
1Mad.Father...ay.dll
windows11-21h2-x64
3Mad.Father...64.dll
windows11-21h2-x64
1Mad.Father...pi.dll
windows11-21h2-x64
1Mad.Father...PC.url
windows11-21h2-x64
1Mad.Father...up.exe
windows11-21h2-x64
7Mad.Father...up.exe
windows11-21h2-x64
7Mad.Father...st.exe
windows11-21h2-x64
6Mad.Father...64.exe
windows11-21h2-x64
7Mad.Father...86.exe
windows11-21h2-x64
7Mad.Father...64.exe
windows11-21h2-x64
7Mad.Father...86.exe
windows11-21h2-x64
7Mad.Father...st.msi
windows11-21h2-x64
6Analysis
-
max time kernel
299s -
max time network
309s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-05-2024 19:12
Static task
static1
Behavioral task
behavioral1
Sample
Mad.Father.v11.07.2020.zip
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/Config.exe
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/Data.wolf
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/Game.exe
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/Game.ini
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/LAUNCHER.exe
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/LAUNCHER_x64.exe
Resource
win11-20240419-en
Behavioral task
behavioral8
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu.ini
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu.txt
Resource
win11-20240508-en
Behavioral task
behavioral10
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Common/218620/inventory.bin
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Common/218620/item_schema.bin
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Common/620/items.bin
Resource
win11-20240426-en
Behavioral task
behavioral13
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Common/730/items.bin
Resource
win11-20240426-en
Behavioral task
behavioral14
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Common/Readme.txt
Resource
win11-20240508-en
Behavioral task
behavioral15
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Common/avatar.png
Resource
win11-20240426-en
Behavioral task
behavioral16
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/SSEFirewall.ini
Resource
win11-20240426-en
Behavioral task
behavioral17
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/SSEOverlay.ini
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/SSEOverlay/Language.ini
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/SSEOverlay/message.wav
Resource
win11-20240426-en
Behavioral task
behavioral20
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/x64/SSEOverlay.dll
Resource
win11-20240426-en
Behavioral task
behavioral21
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/x86/SSEOverlay.dll
Resource
win11-20240508-en
Behavioral task
behavioral22
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu64.dll
Resource
win11-20240426-en
Behavioral task
behavioral23
Sample
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/steam_api.dll
Resource
win11-20240508-en
Behavioral task
behavioral24
Sample
Mad.Father.v11.07.2020/STEAMUNLOCKED ยป Free Steam Games Pre-installed for PC.url
Resource
win11-20240508-en
Behavioral task
behavioral25
Sample
Mad.Father.v11.07.2020/_Redist/dotNetFx40_Full_setup.exe
Resource
win11-20240419-en
Behavioral task
behavioral26
Sample
Mad.Father.v11.07.2020/_Redist/dxwebsetup.exe
Resource
win11-20240508-en
Behavioral task
behavioral27
Sample
Mad.Father.v11.07.2020/_Redist/oalinst.exe
Resource
win11-20240426-en
Behavioral task
behavioral28
Sample
Mad.Father.v11.07.2020/_Redist/vcredist_2015-2019_x64.exe
Resource
win11-20240426-en
Behavioral task
behavioral29
Sample
Mad.Father.v11.07.2020/_Redist/vcredist_2015-2019_x86.exe
Resource
win11-20240508-en
Behavioral task
behavioral30
Sample
Mad.Father.v11.07.2020/_Redist/vcredist_x64.exe
Resource
win11-20240426-en
Behavioral task
behavioral31
Sample
Mad.Father.v11.07.2020/_Redist/vcredist_x86.exe
Resource
win11-20240508-en
Behavioral task
behavioral32
Sample
Mad.Father.v11.07.2020/_Redist/xnafx40_redist.msi
Resource
win11-20240426-en
General
-
Target
Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/LAUNCHER.exe
-
Size
227KB
-
MD5
0e7fde098d64a93e60191d25e06bf642
-
SHA1
8d0973ef176d03f68d33c4d9e6595ba8c988ff1f
-
SHA256
44e6e2035db0ab9c4e811e7418c72f01f50e675dbdffd8114e29f965ec62eb38
-
SHA512
b3a63341882abc284bd8d2718608d7c60b565227e672450497f83f4c72890547b49f3730382a87c94cb2faf172397d79d1108a74068b3e1b5465736dcea98006
-
SSDEEP
3072:Yz14duOvSxCLLT9qCOY4jb1pQzhHKPtOnO6VrVPoVJtCbhVPoVJtCbFy5w:i14duK5X5mYQydHKPtOnRWehWeQ5
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exeGame.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe File opened for modification \??\PhysicalDrive0 Game.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Game.exerundll32.exepid process 4336 Game.exe 4336 Game.exe 4336 Game.exe 4336 Game.exe 4336 Game.exe 4336 Game.exe 4336 Game.exe 4336 Game.exe 4336 Game.exe 4336 Game.exe 4336 Game.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Game.exepid process 4336 Game.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 3824 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3824 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Game.exepid process 4336 Game.exe 4336 Game.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
LAUNCHER.exeGame.exedescription pid process target process PID 1224 wrote to memory of 4336 1224 LAUNCHER.exe Game.exe PID 1224 wrote to memory of 4336 1224 LAUNCHER.exe Game.exe PID 1224 wrote to memory of 4336 1224 LAUNCHER.exe Game.exe PID 4336 wrote to memory of 2828 4336 Game.exe rundll32.exe PID 4336 wrote to memory of 2828 4336 Game.exe rundll32.exe PID 4336 wrote to memory of 2828 4336 Game.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\LAUNCHER.exe"C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\LAUNCHER.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\Game.exe"C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\Game.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu.dll",InitSSE3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu\Plugins\SSEOverlay.iniFilesize
34B
MD5480005b54033d978380bff940142462d
SHA1e84e358f9c806852d2c3a54f98a85c35754c21e9
SHA256546bde00c0b7a1df06d6dc2d2e47c32a2bcc7df94b0025685b71e321acf07f0d
SHA512a517dcf5958ae24c2c1dcd89a7a5383673df68767932aba64348ad619b060eac12973054811534dc9963c89f553f2d366a212f35548b05503a936208f1badc61
-
memory/2828-11-0x0000000077574000-0x0000000077575000-memory.dmpFilesize
4KB
-
memory/2828-16-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/2828-17-0x0000000077574000-0x0000000077575000-memory.dmpFilesize
4KB
-
memory/4336-1-0x0000000002FE0000-0x0000000002FF0000-memory.dmpFilesize
64KB
-
memory/4336-0-0x0000000077574000-0x0000000077575000-memory.dmpFilesize
4KB
-
memory/4336-3-0x0000000003030000-0x0000000003040000-memory.dmpFilesize
64KB