Overview
overview
10Static
static
3Loader.rar
windows7-x64
3Loader.rar
windows10-2004-x64
3Loader/Loader.rar
windows7-x64
3Loader/Loader.rar
windows10-2004-x64
3Loader/Ant...sabler
windows7-x64
1Loader/Ant...sabler
windows10-2004-x64
1Loader/Gam...Inject
windows7-x64
1Loader/Gam...Inject
windows10-2004-x64
1Loader/Gam...meMenu
windows7-x64
1Loader/Gam...meMenu
windows10-2004-x64
1Loader/Gam...Status
windows7-x64
1Loader/Gam...Status
windows10-2004-x64
1Loader/GameDetect
windows7-x64
1Loader/GameDetect
windows10-2004-x64
1Loader/Launcher.dll
windows7-x64
1Loader/Launcher.dll
windows10-2004-x64
1Loader/Loader.exe
windows7-x64
10Loader/Loader.exe
windows10-2004-x64
10Loader/Upd...pdater
windows7-x64
1Loader/Upd...pdater
windows10-2004-x64
1Loader/Upd...eb.xml
windows7-x64
1Loader/Upd...eb.xml
windows10-2004-x64
1Loader/config
windows7-x64
1Loader/config
windows10-2004-x64
1Loader/mainf.dll
windows7-x64
1Loader/mainf.dll
windows10-2004-x64
1Loader/mco...ig.xml
windows7-x64
1Loader/mco...ig.xml
windows10-2004-x64
1Loader/Password.txt
windows7-x64
1Loader/Password.txt
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
Loader.rar
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Loader.rar
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Loader/Loader.rar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Loader/Loader.rar
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Loader/AntiCheatDisabler
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
Loader/AntiCheatDisabler
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Loader/GameCheck/GameInject
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Loader/GameCheck/GameInject
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Loader/GameCheck/GameMenu
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
Loader/GameCheck/GameMenu
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Loader/GameCheck/GameStatus
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
Loader/GameCheck/GameStatus
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Loader/GameDetect
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Loader/GameDetect
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Loader/Launcher.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
Loader/Launcher.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
Loader/Loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Loader/Loader.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Loader/Updater/Updater
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
Loader/Updater/Updater
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Loader/Updater/web.xml
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
Loader/Updater/web.xml
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Loader/config
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
Loader/config
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Loader/mainf.dll
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
Loader/mainf.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Loader/mconfig/config.xml
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
Loader/mconfig/config.xml
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
Loader/Password.txt
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
Loader/Password.txt
Resource
win10v2004-20240611-en
General
-
Target
Loader/Loader.rar
-
Size
3.8MB
-
MD5
6708336a25163b73dd47bc09f57818fa
-
SHA1
36a31642c5f77cba5c4c0de905063e0b033a4986
-
SHA256
b1ee03942664668e5e21997036234359542ee889c8d51e2699cbe6c8727cd19d
-
SHA512
34e8f4913a393f71032699b32deb65103268b72e830ca870003a117a0c4a9bd7d4fb2e60cb520788fbffc08ec6cb9b189d93995d5f93e864befe89cf7946cbf1
-
SSDEEP
98304:Z+Vnp8HuN4umIeUr8A6dIoYzMl+/lHOlmvLYdZEyt:speulevALXZlI8GZEyt
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2672 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2672 7zFM.exe Token: 35 2672 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2672 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2672 1756 cmd.exe 29 PID 1756 wrote to memory of 2672 1756 cmd.exe 29 PID 1756 wrote to memory of 2672 1756 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Loader\Loader.rar1⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Loader\Loader.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2672
-