c13e1077bb0242e94c449d1baf2381a7267c44ebbf438c2f935437c0e21e503a | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Carbon_v1.7 (Beta)/CarbonLauncher.exe
Size

490KB
MD5

73be403f4d37ef75d4b1d93d998c33d3
SHA1

3dfefa3d5dee27693d8702b082ae402e35ae17b4
SHA256

dd96a4865a1464b59087003356ec17b4b3d654182f803a9db555641b500d98fa
SHA512

9aa4d9fa4f8847778b3948621968c98341507cced7b735897b0e557eba08c4891ef412608a0282c59e3cff74d12ac23ca35e2f76e7ab84855650a2718e5975f8
SSDEEP

6144:3ZZLRzDbtkKq1wwF476b60guIEgOei2U:JZl+n47w4u

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\discord-883799917422846013\URL Protocol	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\discord-883799917422846013\shell\open	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\discord-883799917422846013	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\discord-883799917422846013\DefaultIcon	CarbonLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\discord-883799917422846013\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Carbon_v1.7 (Beta)\\CarbonLauncher.exe"	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\discord-883799917422846013\shell\open\command	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\discord-883799917422846013\shell	CarbonLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\discord-883799917422846013\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Carbon_v1.7 (Beta)\\CarbonLauncher.exe"	CarbonLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\discord-883799917422846013\ = "URL:Run game 883799917422846013 protocol"	CarbonLauncher.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2088	CarbonLauncher.exe
2088	CarbonLauncher.exe
2088	CarbonLauncher.exe
2088	CarbonLauncher.exe
2088	CarbonLauncher.exe
2088	CarbonLauncher.exe
2088	CarbonLauncher.exe
2088	CarbonLauncher.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 316	2088	CarbonLauncher.exe	32
PID 2088 wrote to memory of 316	2088	CarbonLauncher.exe	32
PID 2088 wrote to memory of 316	2088	CarbonLauncher.exe	32

C:\Users\Admin\AppData\Local\Temp\Carbon_v1.7 (Beta)\CarbonLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\Carbon_v1.7 (Beta)\CarbonLauncher.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads