Overview
overview
10Static
static
10Awesom-O/A...er.exe
windows7-x64
7Awesom-O/A...er.exe
windows10-2004-x64
7Awesom-O/A...er.exe
windows7-x64
7Awesom-O/A...er.exe
windows10-2004-x64
7Awesom-O/A...or.exe
windows7-x64
7Awesom-O/A...or.exe
windows10-2004-x64
7Awesom-O/A...er.exe
windows7-x64
7Awesom-O/A...er.exe
windows10-2004-x64
7Awesom-O/A...om.exe
windows7-x64
7Awesom-O/A...om.exe
windows10-2004-x64
7Awesom-O/Awesom-O.dll
windows7-x64
3Awesom-O/Awesom-O.dll
windows10-2004-x64
3Awesom-O/Awesom-O.exe
windows7-x64
3Awesom-O/Awesom-O.exe
windows10-2004-x64
3Awesom-O/c...ll.vbs
windows7-x64
1Awesom-O/c...ll.vbs
windows10-2004-x64
1Awesom-O/c....1.pdf
windows7-x64
3Awesom-O/c....1.pdf
windows10-2004-x64
3Awesom-O/c...cs.pdf
windows7-x64
3Awesom-O/c...cs.pdf
windows10-2004-x64
3Awesom-O/c...ll.vbs
windows7-x64
1Awesom-O/c...ll.vbs
windows10-2004-x64
1Awesom-O/c...le.vbs
windows7-x64
1Awesom-O/c...le.vbs
windows10-2004-x64
1Awesom-O/c...ies.js
windows7-x64
3Awesom-O/c...ies.js
windows10-2004-x64
3Awesom-O/c...es.vbs
windows7-x64
1Awesom-O/c...es.vbs
windows10-2004-x64
1Awesom-O/c...ets.js
windows7-x64
3Awesom-O/c...ets.js
windows10-2004-x64
3Awesom-O/c...ons.js
windows7-x64
3Awesom-O/c...ons.js
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 06:34
Behavioral task
behavioral1
Sample
Awesom-O/AOHelpers/Awesom-O Debugger.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
Awesom-O/AOHelpers/Awesom-O Debugger.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Awesom-O/AOHelpers/BotINIManager.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
Awesom-O/AOHelpers/BotINIManager.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Awesom-O/AOHelpers/PREditor.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
Awesom-O/AOHelpers/PREditor.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Awesom-O/AOHelpers/Realm Fixer.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
Awesom-O/AOHelpers/Realm Fixer.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Awesom-O/Auto-Awesom/Auto-Awesom.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
Awesom-O/Auto-Awesom/Auto-Awesom.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Awesom-O/Awesom-O.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
Awesom-O/Awesom-O.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Awesom-O/Awesom-O.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
Awesom-O/Awesom-O.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Awesom-O/config/PR_Docs/ao2luafull.vbs
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral16
Sample
Awesom-O/config/PR_Docs/ao2luafull.vbs
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Awesom-O/config/lua/Docs/PR2.1.pdf
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
Awesom-O/config/lua/Docs/PR2.1.pdf
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Awesom-O/config/lua/Docs/PR_Docs.pdf
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
Awesom-O/config/lua/Docs/PR_Docs.pdf
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Awesom-O/config/lua/Docs/Reference/AO2Lua_Full.vbs
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral22
Sample
Awesom-O/config/lua/Docs/Reference/AO2Lua_Full.vbs
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Awesom-O/config/lua/Docs/Reference/UltraEdit/LuaPR_Wordfile.vbs
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral24
Sample
Awesom-O/config/lua/Docs/Reference/UltraEdit/LuaPR_Wordfile.vbs
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Awesom-O/config/lua/Docs/itemEntries.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
Awesom-O/config/lua/Docs/itemEntries.js
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Awesom-O/config/lua/Docs/itemTables.vbs
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral28
Sample
Awesom-O/config/lua/Docs/itemTables.vbs
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Awesom-O/config/lua/Greedy/PickitRevolution/classic/magic/amulets.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
Awesom-O/config/lua/Greedy/PickitRevolution/classic/magic/amulets.js
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Awesom-O/config/lua/Greedy/PickitRevolution/classic/magic/weapons.js
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral32
Sample
Awesom-O/config/lua/Greedy/PickitRevolution/classic/magic/weapons.js
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
Awesom-O/Auto-Awesom/Auto-Awesom.exe
-
Size
519KB
-
MD5
ae895a8e1e3427949269dce56dc58a52
-
SHA1
e98a3a01dd554a42e916671477e7378e4a8b9f23
-
SHA256
36fefe304625873cb3452f30da3b7d452c5e44b8ff35a9b28f2ad0e3fdd1edaa
-
SHA512
6cd20ce4037672793226954dedcf3c20e2ec991f754880806fbbd3e9ded8e5c6c50fbd7aecc57a6ce37b211e211ee70439f45b2a22c5b6f2c7e2b29dfc054a5e
-
SSDEEP
12288:RA65XwlYgrHy6V17kr8+m73aTPF6aDO49Ij1tQyPd9L+:jwlBrygOW3aYaDO49a1Jdl+
Malware Config
Signatures
-
resource yara_rule behavioral9/memory/3052-0-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral9/memory/3052-1-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral9/memory/3052-2-0x0000000000400000-0x0000000000498000-memory.dmp upx -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral9/memory/3052-1-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral9/memory/3052-2-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Auto-Awesom.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe -
Suspicious use of SendNotifyMessage 15 IoCs
pid Process 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe 3052 Auto-Awesom.exe