c13e1077bb0242e94c449d1baf2381a7267c44ebbf438c2f935437c0e21e503a | Triage

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Carbon_v1.7 (Beta)/CarbonLauncher.exe
Size

490KB
MD5

73be403f4d37ef75d4b1d93d998c33d3
SHA1

3dfefa3d5dee27693d8702b082ae402e35ae17b4
SHA256

dd96a4865a1464b59087003356ec17b4b3d654182f803a9db555641b500d98fa
SHA512

9aa4d9fa4f8847778b3948621968c98341507cced7b735897b0e557eba08c4891ef412608a0282c59e3cff74d12ac23ca35e2f76e7ab84855650a2718e5975f8
SSDEEP

6144:3ZZLRzDbtkKq1wwF476b60guIEgOei2U:JZl+n47w4u

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\discord-883799917422846013\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Carbon_v1.7 (Beta)\\CarbonLauncher.exe"	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\discord-883799917422846013	CarbonLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\discord-883799917422846013\ = "URL:Run game 883799917422846013 protocol"	CarbonLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\discord-883799917422846013\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Carbon_v1.7 (Beta)\\CarbonLauncher.exe"	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\discord-883799917422846013\shell\open\command	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\discord-883799917422846013\shell\open	CarbonLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\discord-883799917422846013\URL Protocol	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\discord-883799917422846013\DefaultIcon	CarbonLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\discord-883799917422846013\shell	CarbonLauncher.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe
3204	CarbonLauncher.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 2112	3204	CarbonLauncher.exe	86
PID 3204 wrote to memory of 2112	3204	CarbonLauncher.exe	86

C:\Users\Admin\AppData\Local\Temp\Carbon_v1.7 (Beta)\CarbonLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\Carbon_v1.7 (Beta)\CarbonLauncher.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads