b8d58233a76881c120c7e025e013baad76a28682f8a3595299417f2d87c3eac7

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_mortal_kombat_trilogy_1.0_hotfix_(58108).exe
Size

224.9MB
MD5

7b23d98123e86d6d7f034f8edaebcf84
SHA1

8b3547a4b8a20ed1684bca2aead4934c80818dc9
SHA256

b8d58233a76881c120c7e025e013baad76a28682f8a3595299417f2d87c3eac7
SHA512

687354fd2ca7a1ace7eefb7910d1c2c91db78ca4d8b07ed93a0980a04d8a826e682bb44f3362c1b583688f1e63dea0bde6fbe2761ad7219485ba5edb4d17cd7b
SSDEEP

6291456:R6fnUnqFY0PpXri/CvbmJUxsA1hcKDKNMyLe+tAjIyBGoPUU:kf+s7oOxdWNMw4jIMfPv

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2128	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp

Loads dropped DLL 6 IoCs

pid	Process
2128	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp
2128	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp
2128	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp
2128	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp
2128	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp
2128	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 2128	732	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).exe	86
PID 732 wrote to memory of 2128	732	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).exe	86
PID 732 wrote to memory of 2128	732	setup_mortal_kombat_trilogy_1.0_hotfix_(58108).exe	86

C:\Users\Admin\AppData\Local\Temp\setup_mortal_kombat_trilogy_1.0_hotfix_(58108).exe
"C:\Users\Admin\AppData\Local\Temp\setup_mortal_kombat_trilogy_1.0_hotfix_(58108).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:732
- C:\Users\Admin\AppData\Local\Temp\is-JEFDN.tmp\setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JEFDN.tmp\setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp" /SL5="$50288,235197240,192512,C:\Users\Admin\AppData\Local\Temp\setup_mortal_kombat_trilogy_1.0_hotfix_(58108).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\1098700594_english.jpg

Filesize
225KB

MD5
3b3790b20332cb47947e71221c806896

SHA1
635359e1356f3ed1385b7e577a652b8b408360db

SHA256
1dfeb6670110e573b765f64a7999a71db1aef972142894fe49823b4f71217b16

SHA512
2d525023d1b9250614011c5b5c4cd73906a53bed990c95ce46ab85f3c367d4aefd57b4b3de8628b8443eb0fe5dab0fd5a7004ae1d39b7452b5c8b7b167fd3962

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\1769415595_english.jpg

Filesize
177KB

MD5
dba7dfe22574a274df7b99b0a8694b1f

SHA1
b518691be45dfcc128f79dd91d120ccb5c762270

SHA256
b8cd12343bc86e0d4c88b6d0240efaf787ecbecd2294773029d7e602942a62fc

SHA512
48825f7b833025229f98d59c5c9e73eb77db8174b1efb1d85de38799dcc727018a3d4e11504e7671771e2855fddc1a427e3fec100848dfc9848eb01f382775a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\BigOK.png

Filesize
3KB

MD5
5b43a5d975a53f4fc1da67ce9f7784c1

SHA1
8543fa1e471030049942252b23cb22e0880c3af5

SHA256
59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a

SHA512
5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\EULAAccepted.png

Filesize
2KB

MD5
461dfeb75927bdb39f9db5348612a611

SHA1
b7893b1fff6801e37ee7337d876962a09184941e

SHA256
0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c

SHA512
68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\EULAShow.png

Filesize
1KB

MD5
c596bc9111edc702bbbb29b70984254f

SHA1
d4712c7b91ff4f8994e7907d31357c42eb47c738

SHA256
6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462

SHA512
db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\background.jpg

Filesize
333KB

MD5
8a14aa1f7da54eecd5b6f03db4b9969e

SHA1
9ea3babfb49286c0850491f3b83eba299d8f559f

SHA256
9a95b6b0851658aab052b83fc98fd492e7d6de61ac22574d001bf5e0f51de3f5

SHA512
587f5774852633d23a52062d0c5dc01f6ce49bc2efd1cf6e3928531cb17d95114bbb9116b88522aff267203411406c865b62db16b70417011b83d883111d5bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\btn_md5.png

Filesize
8KB

MD5
3befe9739354ee24a0b1ea8df05ce274

SHA1
ab0bda986a8c46aa19f57b75a2b7b22445a3c625

SHA256
b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47

SHA512
ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\crcdll.dll

Filesize
69KB

MD5
1d51fac9e2384eeb674199cfd5281d7d

SHA1
861dfdc121357d605d0cc3793266713788109eb2

SHA256
23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec

SHA512
921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\error.png

Filesize
726B

MD5
df10adc25b673e74e19971c17bee5a98

SHA1
ee16fb1cf9491f5e611282f0574b27d76fede412

SHA256
142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b

SHA512
dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\ok.png

Filesize
1KB

MD5
103c1368e60806b1b7995a0894eacf87

SHA1
971392527f6e4b655044773132505c901a6b5469

SHA256
0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e

SHA512
652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\slideshow.ini

Filesize
286B

MD5
bac4f5a94435e938cead767ecfe94bec

SHA1
73804e9e8d6c4222bec327533ab91eabfe47c9a8

SHA256
11be9904230271fcc64acbcbebf44aebc426be1709fc8ed4dc600de2e68f0d88

SHA512
80b2466d24dd15ff5590faa80d8b9420ab35d3ce00c27d42d2e93c6a12bba7c5ba445e30299e6e98d2497dbee2d8ebdcbc430f2706a3a08e4ec06c26f630f3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DA8D3.tmp\uninstall.dll

Filesize
691KB

MD5
7db706c324cc9b6fda497d081eed6e26

SHA1
ca97392e573af0cf61bfa3301801a85f2beea44c

SHA256
cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0

SHA512
8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JEFDN.tmp\setup_mortal_kombat_trilogy_1.0_hotfix_(58108).tmp

Filesize
1.3MB

MD5
4815fed87ad7445917428bffe28e3ec4

SHA1
699f6fc2ccde047ff0facffee09cf95f3e995235

SHA256
8d35ad22480ff4857803953ed4ea58dba198deba168e01e79af37050566388ed

SHA512
898fcf59dd4b4afeb4498e0af35ae3deeecee4bcff14e792d798bfdbfb51d66dad66e1f83359292434778dccf093afadcdd4d5c00ad9f158d365ba4df2795383

Download Submit
memory/732-0-0x0000000000B10000-0x0000000000B49000-memory.dmp

Filesize
228KB

Download
memory/732-2-0x0000000000B11000-0x0000000000B22000-memory.dmp

Filesize
68KB

Download
memory/732-137-0x0000000000B10000-0x0000000000B49000-memory.dmp

Filesize
228KB

Download
memory/2128-138-0x0000000000720000-0x0000000000872000-memory.dmp

Filesize
1.3MB

Download
memory/2128-15-0x0000000003830000-0x00000000038E7000-memory.dmp

Filesize
732KB

Download
memory/2128-136-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/2128-60-0x00000000067C0000-0x00000000067CE000-memory.dmp

Filesize
56KB

Download
memory/2128-6-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/2128-141-0x00000000067C0000-0x00000000067CE000-memory.dmp

Filesize
56KB

Download
memory/2128-140-0x0000000003830000-0x00000000038E7000-memory.dmp

Filesize
732KB

Download
memory/2128-139-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2128-147-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/2128-150-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2128-152-0x00000000067C0000-0x00000000067CE000-memory.dmp

Filesize
56KB

Download