6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninst.exe
Size 1.9MB
Sample240616-pdbpvasfph
SHA256 7d2322f80c0c60135bd2fef4d180eee70266eac624d49aa16db757320198d203
MD5 90c57149c6bb8a6c99f561b4e1ccc608
SHA1 d20a35ae806b42f62b17e4d48899d9715a519c98
SHA512 3ba8c7056ec8b960f0776fae1b6593d2bc8460156b34a1f469561325daf031b680b9cbbec99516d88f92e753e141c9b9388ba9efdde92b6b41cf8e5a21fbbf01
SSDEEP 6144:0e34wCTcFedpWdvqeWi9J1qR5fssLG47ASWLfBM5Ez64NErXDr1R8Dw5c1mx:OTcMWd0gaG0WbBMuz64WjFrx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2004	Au_.exe

Loads dropped DLL 8 IoCs

pid	Process
2116	uninst.exe
2004	Au_.exe
2004	Au_.exe
2004	Au_.exe
2004	Au_.exe
2004	Au_.exe
2004	Au_.exe
2004	Au_.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	gamebox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral25/files/0x0036000000016c7a-2.dat	nsis_installer_1
behavioral25/files/0x0036000000016c7a-2.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2624	gamebox.exe
2624	gamebox.exe
2624	gamebox.exe
2624	gamebox.exe
2624	gamebox.exe
2624	gamebox.exe
2624	gamebox.exe
2624	gamebox.exe
2624	gamebox.exe
2624	gamebox.exe
2624	gamebox.exe
2004	Au_.exe
2004	Au_.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2004	2116	uninst.exe	28
PID 2116 wrote to memory of 2004	2116	uninst.exe	28
PID 2116 wrote to memory of 2004	2116	uninst.exe	28
PID 2116 wrote to memory of 2004	2116	uninst.exe	28
PID 2116 wrote to memory of 2004	2116	uninst.exe	28
PID 2116 wrote to memory of 2004	2116	uninst.exe	28
PID 2116 wrote to memory of 2004	2116	uninst.exe	28
PID 2004 wrote to memory of 2624	2004	Au_.exe	29
PID 2004 wrote to memory of 2624	2004	Au_.exe	29
PID 2004 wrote to memory of 2624	2004	Au_.exe	29
PID 2004 wrote to memory of 2624	2004	Au_.exe	29

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\gamebox.exe
    "C:\Users\Admin\AppData\Local\Temp\gamebox.exe" /uninstallsucc
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lander.ini

Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\Lander.ini
Size 114B
SHA256 7633c12c5d2ca2a88bc520c6e420bbc9dcffacf1ad6bbced23f1f4eb10ea63ce
MD5 10d6560ef9c74f9c5d047be9608dd756
SHA1 c0ee81f744e6eb6003652d667bc7f537215eb28c
SHA512 e8fcb344d4010b80800f54bc0a7547ba6136e40329d96d65cca03836842c8cd7038344763a992b93322dab93e05385f54712124b40c697c76cbedb2009276b04
MD5 SHA1 SHA512

Submit Download

FindProcDLL.dll

Path \Users\Admin\AppData\Local\Temp\nso2BC3.tmp\FindProcDLL.dll
Size 3KB
SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
MD5 8614c450637267afacad1645e23ba24a
SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
MD5 SHA1 SHA512

Submit Download

SkinBtn.dll

Path \Users\Admin\AppData\Local\Temp\nso2BC3.tmp\SkinBtn.dll
Size 4KB
SHA256 ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
MD5 e4ec95271ff1bcebab49bdfed6817a22
SHA1 2c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA512 771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
SSDEEP 48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SkinProgress.dll

Path \Users\Admin\AppData\Local\Temp\nso2BC3.tmp\SkinProgress.dll
Size 4KB
SHA256 888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff
MD5 cc037c4703d3ec257efeef2ce0a1a20e
SHA1 b3d6cc8f687a31fb2c1a5921a38de9429af20502
SHA512 120bfa0a68775bef04c1863023b0e73a41982284fb36da7f497fbb7d5ed8631ad02fa09951424d339f6fefaa90a17c12f949dd68bb33bad64b1b7cace489d2a7
MD5 SHA1 SHA512

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nso2BC3.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

WndProc.dll

Path \Users\Admin\AppData\Local\Temp\nso2BC3.tmp\WndProc.dll
Size 3KB
SHA256 e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
MD5 f0cb331dd4bd92a6ebce45e7cd1cf5ef
SHA1 b66ea0c10b08750295f2dc7c170b370402393214
SHA512 7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
MD5 SHA1 SHA512

Submit Download

nsDialogs.dll

Path \Users\Admin\AppData\Local\Temp\nso2BC3.tmp\nsDialogs.dll
Size 9KB
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

Submit Download

Au_.exe

Path \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 1.9MB
SHA256 7d2322f80c0c60135bd2fef4d180eee70266eac624d49aa16db757320198d203
MD5 90c57149c6bb8a6c99f561b4e1ccc608
SHA1 d20a35ae806b42f62b17e4d48899d9715a519c98
SHA512 3ba8c7056ec8b960f0776fae1b6593d2bc8460156b34a1f469561325daf031b680b9cbbec99516d88f92e753e141c9b9388ba9efdde92b6b41cf8e5a21fbbf01
SSDEEP 6144:0e34wCTcFedpWdvqeWi9J1qR5fssLG47ASWLfBM5Ez64NErXDr1R8Dw5c1mx:OTcMWd0gaG0WbBMuz64WjFrx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2004-49-0x00000000003D0000-0x00000000003D3000-memory.dmp

Download

memory/2004-50-0x00000000003D1000-0x00000000003D2000-memory.dmp

Download

memory/2004-52-0x00000000003D1000-0x00000000003D2000-memory.dmp

Download

memory/2004-51-0x00000000003D0000-0x00000000003D3000-memory.dmp

Download

memory/2004-80-0x00000000003D1000-0x00000000003D2000-memory.dmp

Download