Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 08:16
Static task
static1
Behavioral task
behavioral1
Sample
SkylineEngine.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SkylineEngine.exe
Resource
win10v2004-20240611-en
General
-
Target
SkylineEngine.exe
-
Size
7.8MB
-
MD5
c8403888abf7aee73e032467b757ed25
-
SHA1
345f5a909d675dcfbb77f0cd199384cb656b5be5
-
SHA256
b3e095182c167c34dbb36c1a6b409a6af0fd22799ae8f4f2478f3ca5500c42d2
-
SHA512
b689e7ec0040bcd4d94f077cfc55aea71ccd49a22bc55250e7fa3d82835c568c61bb8aa38975105fce6ba2107de6fb3fb15ffbcc579efe96862278709be18799
-
SSDEEP
196608:NJkBLMIO2o6BxtA/Qh1Ef/0hgbv0FEjURiZKC0WY0cJ99s6EYi46:y4qBxtAs2nEgbv0FDiHcvJ9PEY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Free-SkylineEngine-FiveM.exepid process 1144 Free-SkylineEngine-FiveM.exe -
Loads dropped DLL 1 IoCs
Processes:
SkylineEngine.exepid process 2952 SkylineEngine.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Free-SkylineEngine-FiveM.exe themida behavioral1/memory/1144-10-0x000000013FBC0000-0x0000000140B13000-memory.dmp themida -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SkylineEngine.exedescription pid process target process PID 2952 wrote to memory of 1144 2952 SkylineEngine.exe Free-SkylineEngine-FiveM.exe PID 2952 wrote to memory of 1144 2952 SkylineEngine.exe Free-SkylineEngine-FiveM.exe PID 2952 wrote to memory of 1144 2952 SkylineEngine.exe Free-SkylineEngine-FiveM.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SkylineEngine.exe"C:\Users\Admin\AppData\Local\Temp\SkylineEngine.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\Free-SkylineEngine-FiveM.exe"C:\Users\Admin\AppData\Local\Temp\Free-SkylineEngine-FiveM.exe"2⤵
- Executes dropped EXE
PID:1144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.8MB
MD52580ea7d6388e0c3629e5891b8d361c1
SHA1bbb74ddb6f0f238b4d813c43c0f33fbad723394b
SHA2562fafa653e4db79f1be379644ba97d6aab962bdb6674bdb19853d0b309c68d516
SHA51270fb890aefcea011df629d94471c26657633a2170d26ae9b0825fefd8b8c3530cd6e12dbd4a7db759c375e61a16b86370cdfc11f74f95aafddc4f01a92686374