Analysis

  • max time kernel
    134s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-05-2024 22:02

General

  • Target

    GamesBot.exe

  • Size

    304KB

  • MD5

    e7030b9f2fff58ddd8698a438425b72a

  • SHA1

    13974e7e2000a1b12936d56d4122ebeb1ee1a8db

  • SHA256

    e9abce41317b14a2cb2128d4e211b955da6674bb8fadcad52f8c8c3cf7095e65

  • SHA512

    8a45fe42605d3c05890dea276a7b2d7b99ead90d7e04a8eaba21a8d4993ef45affca7e9cb650f7c5a2ffaf9e783d32931d0e565d963434021aa2075c98ebb990

  • SSDEEP

    6144:Oswhaca6wXsdxbc6MXq2b9DMsEytp/jrxDkzQScRaYRW1ZG:nwNwXatcMY1pt9ZkZj2W1g

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GamesBot.exe
    "C:\Users\Admin\AppData\Local\Temp\GamesBot.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2772
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4020,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
    1⤵
      PID:4400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4

      Filesize

      5B

      MD5

      5bfa51f3a417b98e7443eca90fc94703

      SHA1

      8c015d80b8a23f780bdd215dc842b0f5551f63bd

      SHA256

      bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

      SHA512

      4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

    • memory/2772-26-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-2-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-1-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-24-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-25-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-0-0x0000000075542000-0x0000000075543000-memory.dmp

      Filesize

      4KB

    • memory/2772-30-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-31-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-32-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-33-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-34-0x0000000075542000-0x0000000075543000-memory.dmp

      Filesize

      4KB

    • memory/2772-35-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB

    • memory/2772-36-0x0000000075540000-0x0000000075AF1000-memory.dmp

      Filesize

      5.7MB