Analysis

  • max time kernel
    119s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20-07-2024 09:33

General

  • Target

    Battly-Launcher-Windows.exe

  • Size

    183.1MB

  • MD5

    777dae8f41c5c9ba97b798fcd52612de

  • SHA1

    03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b

  • SHA256

    a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4

  • SHA512

    792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592

  • SSDEEP

    3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe
    "C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\ffmpeg.dll

    Filesize

    2.7MB

    MD5

    bf09deeeb497aeddaf6194e695776b8b

    SHA1

    e7d8719d6d0664b8746581b88eb03a486f588844

    SHA256

    450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080

    SHA512

    38d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f

  • C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\ansi-styles\license

    Filesize

    1KB

    MD5

    915042b5df33c31a6db2b37eadaa00e3

    SHA1

    5aaf48196ddd4d007a3067aa7f30303ca8e4b29c

    SHA256

    48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0

    SHA512

    9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13

  • C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\async\inject.js

    Filesize

    4KB

    MD5

    724bb52915e1158b4dff6f26ef4baf72

    SHA1

    ad0aa6a0ac5576433051167524923e6aa794c96a

    SHA256

    f1e4594194164d2504946c85c8e983346b25f9be8239178defec27e912b56c21

    SHA512

    657c3dec82c5c6c34accdbc9d96e2be59a592e60241960810f10a662f5305c21dcef8cf006fcdefb0d48d30ccdd30d9dd6c263c089a88591f18a83a2f390eaaa

  • C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\src\assets\js\index-es.js

    Filesize

    33KB

    MD5

    ca5f26a1bca7d0379bc07aa2196b9ae1

    SHA1

    384fd58e544cdc1d246e0b5077ebc1fc8e77800e

    SHA256

    7b84738f06f865a0bc533041e12acc8e2c651f153b8df96ca0a43956dddf20f9

    SHA512

    ef19bb165a47de0625499919db32788f7ee8ba563210f525fa7db074b8521345a6e0bc35cf2d51daab7fcc9441dfbb8623f19b34b4ce3fcdd6f65c6173bdab35

  • C:\Users\Admin\AppData\Local\Temp\nsj1BBC.tmp\splash.bmp

    Filesize

    411KB

    MD5

    53b029ccb83951c0f232fbcde874b403

    SHA1

    c6c57b8b7eac7c0f3b7ecff5d4b2a4c1de4d326f

    SHA256

    4a3a74bcc1da624c51860bf3dc2333230cad7c961414e015a987e204f6447461

    SHA512

    514d3e5e925ec16db2ab89d71b34c95ea76f5679dfc4fc2e759c0e982d08660b5ca9a76bbc814ed3335b461ac9e1bf82de2b88dc988f4378e3a974cd59485acb

  • \Users\Admin\AppData\Local\Temp\nsj1BBC.tmp\BgImage.dll

    Filesize

    7KB

    MD5

    487368e6fce9ab9c5ea053af0990c5ef

    SHA1

    b538e37c87d4b9a7645dcbbd9e93025a31849702

    SHA256

    e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04

    SHA512

    bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7

  • \Users\Admin\AppData\Local\Temp\nsj1BBC.tmp\StdUtils.dll

    Filesize

    100KB

    MD5

    c6a6e03f77c313b267498515488c5740

    SHA1

    3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    SHA256

    b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    SHA512

    9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

  • \Users\Admin\AppData\Local\Temp\nsj1BBC.tmp\System.dll

    Filesize

    12KB

    MD5

    0d7ad4f45dc6f5aa87f606d0331c6901

    SHA1

    48df0911f0484cbe2a8cdd5362140b63c41ee457

    SHA256

    3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    SHA512

    c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9