Analysis
- max time kernel
92s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
16/06/2024, 05:20
General
- Target theHunter Call of the Wild v1.0-v1.21 Plus +13 Trainer.exe
- Size 6.1MB
- Sample240616-f1ewcavern
- SHA256 3911090c49c42ddc26c497467f1509e5bf09f33a2b8ecf922e87c1dcb30567a1
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\theHunter Call of the Wild v1.0-v1.21 Plus +13 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\theHunter Call of the Wild v1.0-v1.21 Plus +13 Trainer.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\FutureXGame.com\1.21.0.0\local\stubexe\0x0A0709E0753073B0\theHunter Call of the Wild Trainer.exe"C:\Users\Admin\AppData\Local\FutureXGame.com\1.21.0.0\local\stubexe\0x0A0709E0753073B0\theHunter Call of the Wild Trainer.exe" /864A627C-C6B2-464A-AA13-25D62F282BD82⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
theHunter Call of the Wild Trainer.exe
xsandbox.bin
theHunter Call of the Wild Trainer.exe_0x13CCF9DC8091A09B39552A81004D9F1B.1.manifest
memory/1300-26-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-9-0x0000000003190000-0x000000000334D000-memory.dmp
memory/1300-20-0x0000000003190000-0x000000000334D000-memory.dmp
memory/1300-22-0x0000000003190000-0x000000000334D000-memory.dmp
memory/1300-7-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-6-0x00007FF8E5B2D000-0x00007FF8E5B2E000-memory.dmp
memory/1300-5-0x0000000001140000-0x000000000150F000-memory.dmp
memory/1300-23-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-24-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-8-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-25-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-21-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-124-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-123-0x00007FF8E5B2D000-0x00007FF8E5B2E000-memory.dmp
memory/1300-122-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-121-0x0000000001140000-0x000000000150F000-memory.dmp
memory/1300-15-0x0000000003190000-0x000000000334D000-memory.dmp
memory/1300-75-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-74-0x0000000003190000-0x000000000334D000-memory.dmp
memory/1300-72-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-71-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-0-0x00007FF8E57B0000-0x00007FF8E586E000-memory.dmp
memory/1300-44-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1300-46-0x00007FF8E5A90000-0x00007FF8E5C85000-memory.dmp
memory/1832-42-0x00007FF8E57B0000-0x00007FF8E586E000-memory.dmp
memory/1832-78-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-65-0x00007FF8D7EA0000-0x00007FF8D7F05000-memory.dmp
memory/1832-66-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-67-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-70-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-73-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-93-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-94-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-95-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-91-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-92-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-90-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-89-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-85-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-84-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-82-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-80-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-79-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-57-0x0000000003720000-0x00000000038DD000-memory.dmp
memory/1832-76-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-88-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-87-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-86-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-83-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-81-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-77-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-96-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-97-0x0000000003720000-0x00000000038DD000-memory.dmp
memory/1832-98-0x0000000003720000-0x00000000038DD000-memory.dmp
memory/1832-116-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-117-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-118-0x0000000023E60000-0x0000000023F70000-memory.dmp
memory/1832-120-0x000000002AEE0000-0x000000002B686000-memory.dmp
memory/1832-68-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-69-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-58-0x0000000000400000-0x00000000008E6000-memory.dmp
memory/1832-52-0x0000000003720000-0x00000000038DD000-memory.dmp