649453c43b998ed2c23c87a950e6d4524cc435f995f6352676b09e043e381d5a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ValhallaDSP_KeyGen.exe
Size

559KB
MD5

a4352482c6c31a8722e7a04b83a5cf49
SHA1

b9a4ece533737ffcc0e226f990511748b75af814
SHA256

649453c43b998ed2c23c87a950e6d4524cc435f995f6352676b09e043e381d5a
SHA512

740e7db44137dfda82c082969784fc6b16f7e5ceead61b6ef0ca923e5812077329282a78ad882eadccba0aa0be9778b224957da48eb4148d887d9476ed1d0b24
SSDEEP

12288:XYkc9t2Sll/UA8w4vQuo+KF76OyD/kyS2uB:XYkcL51oQd+KF4/BpK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3808	keygen.exe

Loads dropped DLL 3 IoCs

pid	Process
3808	keygen.exe
3808	keygen.exe
3808	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3624	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3624	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3808	2132	ValhallaDSP_KeyGen.exe	91
PID 2132 wrote to memory of 3808	2132	ValhallaDSP_KeyGen.exe	91
PID 2132 wrote to memory of 3808	2132	ValhallaDSP_KeyGen.exe	91

C:\Users\Admin\AppData\Local\Temp\ValhallaDSP_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\ValhallaDSP_KeyGen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2RJUCE.dll

Filesize
242KB

MD5
90a452c84f7f2b5ca5a61bccaaa17e92

SHA1
3fb5829be5db5af55ee4043f0dce7f9253d800dd

SHA256
674a6eafb277261cd6959a4145329ab8b612fe5948fc8daf064192498fa65f92

SHA512
41304120d3b2d0489fa82c13abce47fca967c6415e28c05382c0c567a167ff400f7d58b843afdfcc33227d4caa8fbb32af38fa7175fd066631fe1bb82615975b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bgm.mod

Filesize
52KB

MD5
d6beadc81bc8481c95996e6333735bbe

SHA1
cae63073b1a77fdd6f101d4b44a3d0c8578829b2

SHA256
014ff2aea33267ae4bb89274b5b6dc48bf22caf051dcc882c339a8c0da705e23

SHA512
139a9ece9a2f7b1ac2fa530be205f545a60c67df1343cba1024ad7b1eb27c39ae84287598be43ba1414eace77814a1359f01361940b5650fcab4e2bd280a4d19

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
733KB

MD5
b42891de36d265662c5ae7bef4432958

SHA1
760f557163dd295fb9f51dc3c6304debabe1fc3f

SHA256
0586b5996c1ecd29d05c3f159f2a74857bc1dcab40552a2495cca936d1349c39

SHA512
43bb4a637465e34544aa5c9b25f236daaa44285b3c8936a4b2e477ec4efc41a30e2a4b1735a0c36006f945b1c1f60e0426c228bee94176115e0c5361bff8b078

Download Submit
memory/3808-20-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-23-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-17-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-18-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-19-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3808-21-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-22-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-14-0x0000000000A10000-0x0000000000A50000-memory.dmp

Filesize
256KB

Download
memory/3808-24-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-25-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-26-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-27-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-28-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-29-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3808-30-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download