Static task
static1
Behavioral task
behavioral1
Sample
pack.rar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
pack/csgo_internal.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
pack/ll_injector.exe
Resource
win10-20240404-en
General
-
Target
pack.rar
-
Size
514KB
-
MD5
cb7c2b5a10a5a3be2f90ea7627d02aa5
-
SHA1
2b82a5deebdeb547c5a501d9283f449f9e3222db
-
SHA256
afe5dbe0f20c5a53c763bc5cce61aeb75648fcd055216fefc08ead1626fa148b
-
SHA512
6f3bc566b35e65b755eff8382444a51f20628d90aa01f419b476f9815fc566bbe10c821fd7b4fce7f0f39278ee7e32409377cbc34164ef28b7553422fe5fbe48
-
SSDEEP
12288:awHDisuVbAf0AW6QNT2m3kFVmVm3TaNj29E5Z1weq:aXs00YV+Cjpfweq
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/pack/csgo_internal.dll unpack001/pack/ll_injector.exe
Files
-
pack.rar.rar
-
pack/csgo_internal.dll.dll windows:6 windows x86 arch:x86
7c4f3fd85311fc5dd9a6a39d002834b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameW
VirtualQuery
VirtualProtect
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ResumeThread
DeleteCriticalSection
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
SetConsoleTitleW
SetStdHandle
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
AllocConsole
GetConsoleWindow
AcquireSRWLockShared
CreateThread
FreeConsole
ReleaseSRWLockShared
AcquireSRWLockExclusive
DisableThreadLibraryCalls
ReleaseSRWLockExclusive
FreeLibraryAndExitThread
InitializeSRWLock
CreateSemaphoreA
CloseHandle
ReleaseSemaphore
WriteConsoleW
WaitForSingleObject
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetLastError
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentThreadId
FormatMessageA
GetStringTypeW
TryAcquireSRWLockExclusive
QueryPerformanceCounter
QueryPerformanceFrequency
LocalFree
GetLocaleInfoEx
Sleep
GetNativeSystemInfo
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
ExitProcess
HeapAlloc
HeapFree
GetStdHandle
GetFileType
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
LCMapStringW
GetLocaleInfoW
IsValidLocale
user32
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
GetKeyState
OpenClipboard
GetAsyncKeyState
LoadCursorW
SetCursor
PostMessageW
FindWindowW
CallWindowProcW
GetForegroundWindow
SetWindowLongW
MapVirtualKeyW
gdi32
SelectObject
CreateDIBSection
CreateCompatibleDC
CreateFontW
GetDeviceCaps
DeleteDC
GetTextExtentPoint32W
SetTextColor
SetBkColor
DeleteObject
SetMapMode
SetTextAlign
ExtTextOutW
AddFontMemResourceEx
RemoveFontMemResourceEx
shell32
ShellExecuteW
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 246KB - Virtual size: 245KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
pack/ll_injector.exe.exe windows:6 windows x86 arch:x86
05e9d3bbf146c164001742a8c1e9e0f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
LoadLibraryW
Module32FirstW
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
Module32NextW
VirtualFreeEx
HeapSize
GetProcessHeap
SetStdHandle
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFinalPathNameByHandleW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
LocalFree
FormatMessageA
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
user32
MessageBoxA
Sections
.text Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ