8e4cbc1921c67a4da479c6719584b0c0191bef5854e902179b45ac4cf9c3a9df

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

leagueoflengends.exe
Size

8.1MB
MD5

04c89e8fe2e5f70706b7313cf45d9f42
SHA1

8af2876b0d37e12e29e804a63fc38950acb3a27c
SHA256

8e4cbc1921c67a4da479c6719584b0c0191bef5854e902179b45ac4cf9c3a9df
SHA512

5dc141b7ec70dc7dcfa529c64c715e15c6e5d702978b99c20b4e60843536f43d9e1d35d28092bd7326cf220d433c655d39d1c0eab8ef04c3e85a2d7e8cc156af
SSDEEP

196608:4nAruDXeIX69onJ5hrZEReyiU8AdZYJERD48RmU/ITvN8wZlsPvZPrTd7Y:hrUnK9c5hlERuAdZYydtNITfZWZrh7Y

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 11 IoCs

Processes:

leagueoflengends.exe

pid	process
4780	leagueoflengends.exe
4780	leagueoflengends.exe
4780	leagueoflengends.exe
4780	leagueoflengends.exe
4780	leagueoflengends.exe
4780	leagueoflengends.exe
4780	leagueoflengends.exe
4780	leagueoflengends.exe
4780	leagueoflengends.exe
4780	leagueoflengends.exe
4780	leagueoflengends.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

leagueoflengends.exe

description	pid	process	target process
PID 2748 wrote to memory of 4780	2748	leagueoflengends.exe	leagueoflengends.exe
PID 2748 wrote to memory of 4780	2748	leagueoflengends.exe	leagueoflengends.exe

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
2⤵
- Loads dropped DLL
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI27482\VCRUNTIME140.dll
Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\VCRUNTIME140_1.dll
Filesize
43KB

MD5
21ae0d0cfe9ab13f266ad7cd683296be

SHA1
f13878738f2932c56e07aa3c6325e4e19d64ae9f

SHA256
7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7

SHA512
6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_ctypes.pyd
Filesize
122KB

MD5
29da9b022c16da461392795951ce32d9

SHA1
0e514a8f88395b50e797d481cbbed2b4ae490c19

SHA256
3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372

SHA512
5c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_tkinter.pyd
Filesize
62KB

MD5
07392b548d2049e35981b7049dfecac7

SHA1
15914110949d98a5fa65705e27f9c11df9e3bab6

SHA256
879839e906969afbfaaed0ef4b58d0d4276d9b4c483decc883fe6b63bd9b67ad

SHA512
448272fd92a9ca6ad2da7a156f7872e2f61ef7e7af210c61893d4103960186eac9118f4d8b123e8a4d953e35bf607ef13f2d46a9553f395d3e131db8d93c4e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\pywin32_system32\pywintypes39.dll
Filesize
131KB

MD5
f20fd2e2ac9058a9fd227172f8ff2c12

SHA1
89eba891352be46581b94a17db7c2ede9a39ab01

SHA256
20bde8e50e42f7aabf59106eea238fcc0dece0c6e362c0a7feeb004ab981db8a

SHA512
42a86fa192aea7adb4283dc48a323a4f687dad40060ea3ffddcd8fd7670bb535d31a7764706e5c5473da28399fec048ae714a111ee238bb25e1aad03e12078d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\tcl86t.dll
Filesize
1.6MB

MD5
c0b23815701dbae2a359cb8adb9ae730

SHA1
5be6736b645ed12e97b9462b77e5a43482673d90

SHA256
f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768

SHA512
ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\tk86t.dll
Filesize
1.4MB

MD5
fdc8a5d96f9576bd70aa1cadc2f21748

SHA1
bae145525a18ce7e5bc69c5f43c6044de7b6e004

SHA256
1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5

SHA512
816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\win32\win32console.pyd
Filesize
58KB

MD5
47be1dc9f556bf2d0fe2237e3194e4d8

SHA1
18642b8238d5423f9e8dd946bfcb2e990b726dd5

SHA256
4a408fe2595f46409a449e17f1f8eaf1f5d0dc3978a594fb4cbf3e90532abbfc

SHA512
e5ea98195bc42f2140f04dea8b59fbdff56f67162baf83f7ff9677361f85f2fd87fea81cba0255164d79777dfd6fff228cfc9418fa93cca1b954d559c6571c53

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\win32\win32gui.pyd
Filesize
212KB

MD5
54ef413eb71819191995af2f6343d5dd

SHA1
991819d574752465b5463600d30f0014ca9fe0ba

SHA256
8fe4d4e5b7ecdc791f54f009e17c516d43bc6abd4cd3a3108a6a1f29768ac8fa

SHA512
49a534df98c7c9abb7c04bc1df900fe3f11602c069cc01bb051aae59847005ec79609c44eb5cb1715dd02f7c1b7f3cb2effe3afad41ad0b83c1499c73ad66c62

Download Submit