b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6

Analysis

max time kernel
26s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ValorantExternalFree_[unknowncheats.me]_.exe
Size

808KB
MD5

4ac882ebdbc1431cdd3ab45e1712ada1
SHA1

b871304fd060b700fd66ce0c87014ec955d12979
SHA256

b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6
SHA512

f3ff8d00849289436b723bc48c14113e51b583955d7f69870458d7b7d72ba214ad531d601a950b247f43325a610fd15cd6584008fd842a29c1dd0804ee2e6f98
SSDEEP

24576:65MOrT+F0sIE9JqsC6mVFyCsffzMS6pcsP9Qtce0TBs/lPsoCyEbDb7Br5oANn90:+bjnS

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\oFYuAIyuvpSDqbmYHRhhl\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\oFYuAIyuvpSDqbmYHRhhl"	ValorantExternalFree_[unknowncheats.me]_.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe
5064	ValorantExternalFree_[unknowncheats.me]_.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5064	ValorantExternalFree_[unknowncheats.me]_.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5064	ValorantExternalFree_[unknowncheats.me]_.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 924	5064	ValorantExternalFree_[unknowncheats.me]_.exe	83
PID 5064 wrote to memory of 924	5064	ValorantExternalFree_[unknowncheats.me]_.exe	83
PID 5064 wrote to memory of 3604	5064	ValorantExternalFree_[unknowncheats.me]_.exe	91
PID 5064 wrote to memory of 3604	5064	ValorantExternalFree_[unknowncheats.me]_.exe	91
PID 5064 wrote to memory of 404	5064	ValorantExternalFree_[unknowncheats.me]_.exe	93
PID 5064 wrote to memory of 404	5064	ValorantExternalFree_[unknowncheats.me]_.exe	93
PID 5064 wrote to memory of 648	5064	ValorantExternalFree_[unknowncheats.me]_.exe	94
PID 5064 wrote to memory of 648	5064	ValorantExternalFree_[unknowncheats.me]_.exe	94
PID 5064 wrote to memory of 2480	5064	ValorantExternalFree_[unknowncheats.me]_.exe	95
PID 5064 wrote to memory of 2480	5064	ValorantExternalFree_[unknowncheats.me]_.exe	95
PID 5064 wrote to memory of 1060	5064	ValorantExternalFree_[unknowncheats.me]_.exe	98
PID 5064 wrote to memory of 1060	5064	ValorantExternalFree_[unknowncheats.me]_.exe	98
PID 5064 wrote to memory of 1072	5064	ValorantExternalFree_[unknowncheats.me]_.exe	99
PID 5064 wrote to memory of 1072	5064	ValorantExternalFree_[unknowncheats.me]_.exe	99
PID 5064 wrote to memory of 2792	5064	ValorantExternalFree_[unknowncheats.me]_.exe	100
PID 5064 wrote to memory of 2792	5064	ValorantExternalFree_[unknowncheats.me]_.exe	100
PID 5064 wrote to memory of 5068	5064	ValorantExternalFree_[unknowncheats.me]_.exe	101
PID 5064 wrote to memory of 5068	5064	ValorantExternalFree_[unknowncheats.me]_.exe	101
PID 5064 wrote to memory of 4464	5064	ValorantExternalFree_[unknowncheats.me]_.exe	102
PID 5064 wrote to memory of 4464	5064	ValorantExternalFree_[unknowncheats.me]_.exe	102
PID 5064 wrote to memory of 1120	5064	ValorantExternalFree_[unknowncheats.me]_.exe	103
PID 5064 wrote to memory of 1120	5064	ValorantExternalFree_[unknowncheats.me]_.exe	103
PID 5064 wrote to memory of 2168	5064	ValorantExternalFree_[unknowncheats.me]_.exe	104
PID 5064 wrote to memory of 2168	5064	ValorantExternalFree_[unknowncheats.me]_.exe	104
PID 5064 wrote to memory of 4384	5064	ValorantExternalFree_[unknowncheats.me]_.exe	105
PID 5064 wrote to memory of 4384	5064	ValorantExternalFree_[unknowncheats.me]_.exe	105
PID 5064 wrote to memory of 896	5064	ValorantExternalFree_[unknowncheats.me]_.exe	106
PID 5064 wrote to memory of 896	5064	ValorantExternalFree_[unknowncheats.me]_.exe	106
PID 5064 wrote to memory of 2292	5064	ValorantExternalFree_[unknowncheats.me]_.exe	107
PID 5064 wrote to memory of 2292	5064	ValorantExternalFree_[unknowncheats.me]_.exe	107
PID 5064 wrote to memory of 3016	5064	ValorantExternalFree_[unknowncheats.me]_.exe	108
PID 5064 wrote to memory of 3016	5064	ValorantExternalFree_[unknowncheats.me]_.exe	108

C:\Users\Admin\AppData\Local\Temp\ValorantExternalFree_[unknowncheats.me]_.exe
"C:\Users\Admin\AppData\Local\Temp\ValorantExternalFree_[unknowncheats.me]_.exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads