Analysis
-
max time kernel
357s -
max time network
358s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 08:51
Behavioral task
behavioral1
Sample
aimwhere_crack/aimwhere.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
aimwhere_crack/aimwhere.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
aimwhere_crack/aimwhere_steam_module.exe
Resource
win7-20240508-en
General
-
Target
aimwhere_crack/aimwhere_steam_module.exe
-
Size
12.5MB
-
MD5
637a214e92b7bfd20ea382ec7305ca1b
-
SHA1
c1da5b2ca143179947c87eb73cf1922412463f43
-
SHA256
0af2bce0e477fcfbd758fccc38940f9d09c33365646e2d90178cdbbad215da11
-
SHA512
5543f96f4bbfe6ef8d97db01fdc5c0934d5b9afbad95176973e067ad901c3a621c6be2eb972c804626597efc1606a19202bff88c869890973eeb0b9cdf4fbcf0
-
SSDEEP
196608:qr3fdO9VinmFhv46MxGTGSIyShO+urErvI9pWjgfPvzm6gsIWjEB4Aum:Od+Jv46eWshO+urEUWjC3zDGWj84Aum
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
aimwhere_steam_module.exepid process 2824 aimwhere_steam_module.exe 2824 aimwhere_steam_module.exe 2824 aimwhere_steam_module.exe 2824 aimwhere_steam_module.exe 2824 aimwhere_steam_module.exe 2824 aimwhere_steam_module.exe 2824 aimwhere_steam_module.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI30562\python311.dll upx behavioral3/memory/2824-75-0x000007FEF59C0000-0x000007FEF5FB2000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
aimwhere_steam_module.exedescription pid process target process PID 3056 wrote to memory of 2824 3056 aimwhere_steam_module.exe aimwhere_steam_module.exe PID 3056 wrote to memory of 2824 3056 aimwhere_steam_module.exe aimwhere_steam_module.exe PID 3056 wrote to memory of 2824 3056 aimwhere_steam_module.exe aimwhere_steam_module.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aimwhere_crack\aimwhere_steam_module.exe"C:\Users\Admin\AppData\Local\Temp\aimwhere_crack\aimwhere_steam_module.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\aimwhere_crack\aimwhere_steam_module.exe"C:\Users\Admin\AppData\Local\Temp\aimwhere_crack\aimwhere_steam_module.exe"2⤵
- Loads dropped DLL
PID:2824
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI30562\api-ms-win-core-file-l2-1-0.dllFilesize
11KB
MD5721b60b85094851c06d572f0bd5d88cd
SHA14d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7
SHA256dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf
SHA512430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b
-
C:\Users\Admin\AppData\Local\Temp\_MEI30562\api-ms-win-core-localization-l1-2-0.dllFilesize
14KB
MD51ed0b196ab58edb58fcf84e1739c63ce
SHA1ac7d6c77629bdee1df7e380cc9559e09d51d75b7
SHA2568664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2
SHA512e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b
-
C:\Users\Admin\AppData\Local\Temp\_MEI30562\api-ms-win-core-processthreads-l1-1-1.dllFilesize
11KB
MD57e8b61d27a9d04e28d4dae0bfa0902ed
SHA1861a7b31022915f26fb49c79ac357c65782c9f4b
SHA2561ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c
SHA5121c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d
-
C:\Users\Admin\AppData\Local\Temp\_MEI30562\python311.dllFilesize
1.6MB
MD5ccdbd8027f165575a66245f8e9d140de
SHA1d91786422ce1f1ad35c528d1c4cd28b753a81550
SHA256503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971
SHA512870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311
-
C:\Users\Admin\AppData\Local\Temp\_MEI30562\ucrtbase.dllFilesize
1011KB
MD5849959a003fa63c5a42ae87929fcd18b
SHA1d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA2566238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
SHA51264958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
-
\Users\Admin\AppData\Local\Temp\_MEI30562\api-ms-win-core-file-l1-2-0.dllFilesize
11KB
MD55a72a803df2b425d5aaff21f0f064011
SHA14b31963d981c07a7ab2a0d1a706067c539c55ec5
SHA256629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086
SHA512bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69
-
\Users\Admin\AppData\Local\Temp\_MEI30562\api-ms-win-core-timezone-l1-1-0.dllFilesize
11KB
MD591a2ae3c4eb79cf748e15a58108409ad
SHA1d402b9df99723ea26a141bfc640d78eaf0b0111b
SHA256b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34
SHA5128527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed
-
memory/2824-75-0x000007FEF59C0000-0x000007FEF5FB2000-memory.dmpFilesize
5.9MB