Analysis
-
max time kernel
454s -
max time network
1178s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
SpaceCheats_v3.5.zip
Resource
win10v2004-20240508-en
General
-
Target
SpaceCheats_v3.5/installer.exe
-
Size
907KB
-
MD5
6b3ee7e991ba70fc5766aff36c5d2a34
-
SHA1
8388ea924f59abe9814673acc9f777abe2ac9cf4
-
SHA256
d7a40406412086b8e1657644c7f9f326227a790a2c9ddb6b57dfe450c92d051a
-
SHA512
8e0f3ef14f6fdfb907d81fc0376936ba819032463532cce899c794ab56430473ad629587d823ee9a75784d37a3d7b63a43967e72a1b8573ef847149a56faa207
-
SSDEEP
24576:3tASL4DJntBcspjPeQiPvdRzWTn6WHmTyC5oq3zLUkPNsFiy94Zv:z4DJntBcs1eQiPvdRzyYy2z5FsIA41
Malware Config
Extracted
lumma
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
installer.exedescription pid process target process PID 1064 set thread context of 4472 1064 installer.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 664 1064 WerFault.exe installer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
installer.exedescription pid process target process PID 1064 wrote to memory of 1704 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 1704 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 1704 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 4472 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 4472 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 4472 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 4472 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 4472 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 4472 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 4472 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 4472 1064 installer.exe RegAsm.exe PID 1064 wrote to memory of 4472 1064 installer.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpaceCheats_v3.5\installer.exe"C:\Users\Admin\AppData\Local\Temp\SpaceCheats_v3.5\installer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1704
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 2882⤵
- Program crash
PID:664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1064 -ip 10641⤵PID:5028