Overview

overview

9

Static

static

3

Rivals of ...er.exe

windows11-21h2-x64

Rivals of ...es.url

windows11-21h2-x64

1

Rivals of ...ml.dll

windows11-21h2-x64

3

Rivals of ...es.url

windows11-21h2-x64

1

Rivals of ...up.exe

windows11-21h2-x64

7

Rivals of ...up.exe

windows11-21h2-x64

7

Rivals of ...ll.bat

windows11-21h2-x64

7

Rivals of ...st.exe

windows11-21h2-x64

6

Rivals of ...64.exe

windows11-21h2-x64

7

Rivals of ...86.exe

windows11-21h2-x64

7

Rivals of ...64.exe

windows11-21h2-x64

7

Rivals of ...86.exe

windows11-21h2-x64

7

Rivals of ...64.exe

windows11-21h2-x64

7

Rivals of ...86.exe

windows11-21h2-x64

7

Rivals of ...64.exe

windows11-21h2-x64

7

Rivals of ...86.exe

windows11-21h2-x64

7

Rivals of ...64.exe

windows11-21h2-x64

7

Rivals of ...86.exe

windows11-21h2-x64

7

Rivals of ...64.exe

windows11-21h2-x64

4

Rivals of ...86.exe

windows11-21h2-x64

4

Rivals of ...64.exe

windows11-21h2-x64

7

Rivals of ...86.exe

windows11-21h2-x64

7

Rivals of ...64.exe

windows11-21h2-x64

7

Rivals of ...86.exe

windows11-21h2-x64

7

Rivals of ...st.msi

windows11-21h2-x64

6

Rivals of ...p.html

windows11-21h2-x64

1

Rivals of ...ni.dll

windows11-21h2-x64

3

Rivals of ...le.dll

windows11-21h2-x64

3

Rivals of ...us.dll

windows11-21h2-x64

3

Rivals of ...ed.dll

windows11-21h2-x64

3

Rivals of ...pi.dll

windows11-21h2-x64

3

Rivals of ...pi.dll

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rivals of Aether - SteamGG.net.zip

  • Size

    348.7MB

  • Sample

    240808-v8fvyawgml

  • MD5

    11be54a1e875c37025c4e980a7a83bc6

  • SHA1

    c6fb875744cfffb18d1c1b63bf6811568e95e403

  • SHA256

    b0b102f329f39c350c84c754420fd15e073e7a8f32dbfcd3478a3305b7f2e8f2

  • SHA512

    9e0ad211a68e795576fef5aadc8e432c5babb5c7ba2504ca0d5098023f4ac8b9f09ce0dc2c388a8a9092ed51306e347ec6eeea90e5200a105eef79267b9f9077

  • SSDEEP

    6291456:eZ23+nf34ETsdOEms3skQDqHdi95k/7YfCVJ+/BXZHf9Z3Ld6b0lpCeddClKqE2W:biAClsVQDgd8k/7Yq7+/T/f3B6bIpCep

Score
9/10
credential_accessdiscoverymotwpersistencephishingprivilege_escalationstealer

Malware Config

Targets

    • Target

      Rivals of Aether - SteamGG.net/RivalsofAether.exe

    • Size

      95.8MB

    • MD5

      ffdf654e5548ccdeb46d7ba00c9ed28b

    • SHA1

      ba07d47a7685a37f536636579c66f631887790e3

    • SHA256

      462e21110c94d1dc02bd278da3e1bc5a63ba56527611b4b80990f7cbbb3792c4

    • SHA512

      fa06fcead6798fc82c6b0e581d2f6d6eef3ba1ae23bb2ad8fb6be56df3faf60d5cff76ad970694e7d73680b68ae6d8df64e40ca2dc1f049a4b1d5dc8e01f7740

    • SSDEEP

      1572864:j+Cgd7d6rWRgWzBxy8/GAj5FtaachwsV:yd2WRgWzBxy8/GAj5FtaachwsV

    Score
    9/10
    credential_accessdiscoverymotwpersistencephishingstealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

      phishingmotw

    • Drops file in System32 directory

    behavioral1

    • Target

      Rivals of Aether - SteamGG.net/SteamGG – Free Download Pre-installed Steam Games.url

    • Size

      46B

    • MD5

      8c6558b2a4973b914d2f3e180bd1e7f3

    • SHA1

      61636d273a77186cfdcd939e048441c46d569ede

    • SHA256

      dc8ccfbd89a0b5e94c825fdebae3e48923ed43b7b6a4880b398b5a378dd18572

    • SHA512

      c8a456bc7557c92806e6debb85dec57361418a52d5ea7b5cbc67419b90ef68a87bbc1b532f983bb0eae32af5f44ff566f21d878413ac96bf8083bb1c15bb63e5

    Score
    1/10
    behavioral2

    • Target

      Rivals of Aether - SteamGG.net/Steamworks.gml.dll

    • Size

      137KB

    • MD5

      981993c664f6974d3bda632ab3bd1570

    • SHA1

      f58b50101b8dff2ddf01b44f675ce903b41f7f70

    • SHA256

      f5c674393c6848a70a4a91cb58c612c39bee0df57058d45c677631f9927e038d

    • SHA512

      175b33d30b80c699e1e5e7d54dd2d4b16596bae5c9fae1d0b868288798fd472b648851b4dc9d477a75c3342ede68581eddd6c69aa941c95452cc0552613a4aae

    • SSDEEP

      3072:rAfEOUTC1Lw4JRoLphJj8XfmpKA6JbWnUr6neKuPlr8YeFps8fnwCcX6VN9Jj8cb:8fEOEC1hR6dwfMKVQUEuPlr8YeFNTXoe

    Score
    3/10
    discovery
    behavioral3

    • Target

      Rivals of Aether - SteamGG.net/_Redist/SteamGG – Free Download Pre-installed Steam Games.url

    • Size

      46B

    • MD5

      8c6558b2a4973b914d2f3e180bd1e7f3

    • SHA1

      61636d273a77186cfdcd939e048441c46d569ede

    • SHA256

      dc8ccfbd89a0b5e94c825fdebae3e48923ed43b7b6a4880b398b5a378dd18572

    • SHA512

      c8a456bc7557c92806e6debb85dec57361418a52d5ea7b5cbc67419b90ef68a87bbc1b532f983bb0eae32af5f44ff566f21d878413ac96bf8083bb1c15bb63e5

    Score
    1/10
    behavioral4

    • Target

      Rivals of Aether - SteamGG.net/_Redist/dotNetFx40_Full_setup.exe

    • Size

      868KB

    • MD5

      53406e9988306cbd4537677c5336aba4

    • SHA1

      06becadb92a5fcca2529c0b93687c2a0c6d0d610

    • SHA256

      fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425

    • SHA512

      4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99

    • SSDEEP

      24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral5

    • Target

      Rivals of Aether - SteamGG.net/_Redist/dxwebsetup.exe

    • Size

      281KB

    • MD5

      fd6057b33e15a553ddc5d9873723ce8f

    • SHA1

      f90efb623b5abea70af63c470daa8674444fb1df

    • SHA256

      111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288

    • SHA512

      d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d

    • SSDEEP

      6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc

    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral6

    • Target

      Rivals of Aether - SteamGG.net/_Redist/install_all.bat

    • Size

      1KB

    • MD5

      eb55aae630088c91b88d2bfae4115ea0

    • SHA1

      1495c69946edca474fe30c2b713aacb9f03bbf3a

    • SHA256

      492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17

    • SHA512

      48e4a3fa644b1859131cfec782641aaee9938c88f939ca0509df0f4120b922187753ce7cd7d912d2f90108526ba34d767baa28c9eeeb25d43fff77d38ddfd882

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral7

    • Target

      Rivals of Aether - SteamGG.net/_Redist/oalinst.exe

    • Size

      790KB

    • MD5

      694f54bd227916b89fc3eb1db53f0685

    • SHA1

      21fdc367291bbef14dac27925cae698d3928eead

    • SHA256

      b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd

    • SHA512

      55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5

    • SSDEEP

      12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV

    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral8

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2005_x64.exe

    • Size

      3.0MB

    • MD5

      56eaf4e1237c974f6984edc93972c123

    • SHA1

      ee916012783024dac67fc606457377932c826f05

    • SHA256

      0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0

    • SHA512

      f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736

    • SSDEEP

      49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral9

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2005_x86.exe

    • Size

      2.6MB

    • MD5

      ce2922f83fb4b170affce0ea448b107b

    • SHA1

      b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847

    • SHA256

      4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29

    • SHA512

      e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0

    • SSDEEP

      49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2008_x64.exe

    • Size

      5.0MB

    • MD5

      e2ada570911edaaae7d1b3c979345fce

    • SHA1

      a7c83077b8a28d409e36316d2d7321fa0ccdb7e8

    • SHA256

      b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665

    • SHA512

      b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8

    • SSDEEP

      98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2008_x86.exe

    • Size

      4.3MB

    • MD5

      35da2bf2befd998980a495b6f4f55e60

    • SHA1

      470640aa4bb7db8e69196b5edb0010933569e98d

    • SHA256

      6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

    • SHA512

      bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

    • SSDEEP

      98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral12

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2010_x64.exe

    • Size

      9.8MB

    • MD5

      c9d9eebccef20d637f193490cec05e79

    • SHA1

      15d032d669078aa6f0f7fd1cbf4115a070bd034d

    • SHA256

      cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223

    • SHA512

      24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6

    • SSDEEP

      196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral13

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2010_x86.exe

    • Size

      8.6MB

    • MD5

      1801436936e64598bab5b87b37dc7f87

    • SHA1

      28c54491be70c38c97849c3d8cfbfdd0d3c515cb

    • SHA256

      67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d

    • SHA512

      0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c

    • SSDEEP

      196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral14

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2012_x64.exe

    • Size

      6.9MB

    • MD5

      3c03562b5af9ed347614053d459d7778

    • SHA1

      1a5d93dddbc431ab27b1da711cd3370891542797

    • SHA256

      681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064

    • SHA512

      6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75

    • SSDEEP

      98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral15

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2012_x86.exe

    • Size

      6.3MB

    • MD5

      7f52a19ecaf7db3c163dd164be3e592e

    • SHA1

      96b377a27ac5445328cbaae210fc4f0aaa750d3f

    • SHA256

      b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386

    • SHA512

      60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b

    • SSDEEP

      196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral16

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2013_x64.exe

    • Size

      6.9MB

    • MD5

      49b1164f8e95ec6409ea83cdb352d8da

    • SHA1

      1194e6bf4153fa88f20b2a70ac15bc359ada4ee2

    • SHA256

      a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c

    • SHA512

      29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60

    • SSDEEP

      196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral17

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2013_x86.exe

    • Size

      6.2MB

    • MD5

      38a1b890ce847167d16567cf7b7a5642

    • SHA1

      0f5d66bcaf120f2d3f340e448a268fe4bbf7709d

    • SHA256

      53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd

    • SHA512

      907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd

    • SSDEEP

      196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral18

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2015_2017_2019_2022_x64.exe

    • Size

      24.2MB

    • MD5

      a8a68bcc74b5022467f12587baf1ef93

    • SHA1

      046f00c519900fcbf2e6e955fc155b11156a733b

    • SHA256

      1ad7988c17663cc742b01bef1a6df2ed1741173009579ad50a94434e54f56073

    • SHA512

      70a05bde549e5a973397cd77fe0c6380807cae768aa98454830f321a0de64bd0da30f31615ae6b4d9f0d244483a571e46024cf51b20fe813a6304a74bd8c0cc2

    • SSDEEP

      393216:Dwlp+dkBSuF2SfUfn6+eDl2ugjMoA+hxV33wsBH+Jh+5l+BvlOchteAHYhx9vy:DMp+Ty2SfUfnxk/kpsjlOchcEu2

    Score
    4/10
    discovery
    behavioral19

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist2015_2017_2019_2022_x86.exe

    • Size

      13.2MB

    • MD5

      9882a328c8414274555845fa6b542d1e

    • SHA1

      ab4a97610b127d68c45311deabfbcd8aa7066f4b

    • SHA256

      510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79

    • SHA512

      c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2

    • SSDEEP

      196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE

    Score
    4/10
    discovery
    behavioral20

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist_2015-2019_x64.exe

    • Size

      14.3MB

    • MD5

      f0248d477e74687c5619ae16498b13d4

    • SHA1

      9ed4b091148c9b53f66b3f2c69be7e60e74c486a

    • SHA256

      b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52

    • SHA512

      0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591

    • SSDEEP

      393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral21

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist_2015-2019_x86.exe

    • Size

      13.7MB

    • MD5

      de34b1c517e0463602624bbc8294c08d

    • SHA1

      5ce7923ffea712468c05e7ac376dd9c29ea9f6be

    • SHA256

      ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6

    • SHA512

      114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac

    • SSDEEP

      393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral22

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist_x64.exe

    • Size

      5.5MB

    • MD5

      630d75210b325a280c3352f879297ed5

    • SHA1

      b330b760a8f16d5a31c2dc815627f5eb40861008

    • SHA256

      b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023

    • SHA512

      b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f

    • SSDEEP

      98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral23

    • Target

      Rivals of Aether - SteamGG.net/_Redist/vcredist_x86.exe

    • Size

      4.8MB

    • MD5

      b88228d5fef4b6dc019d69d4471f23ec

    • SHA1

      372d9c1670343d3fb252209ba210d4dc4d67d358

    • SHA256

      8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8

    • SHA512

      cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8

    • SSDEEP

      98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral24

    • Target

      Rivals of Aether - SteamGG.net/_Redist/xnafx40_redist.msi

    • Size

      6.7MB

    • MD5

      97c2eebb30c5a88c68c8f24f37183f1d

    • SHA1

      49efdc29f65fc8263c196338552c7009fc96c5de

    • SHA256

      e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7

    • SHA512

      c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da

    • SSDEEP

      98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq

    Score
    6/10

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral25

    • Target

      Rivals of Aether - SteamGG.net/catch_error_help.html

    • Size

      43KB

    • MD5

      424b243fbd586acdf924847d118ab86a

    • SHA1

      07487ffa752df83e92708ee560f4935f1809ee04

    • SHA256

      cf0fcf4fec72f7a7e449839195f09114d2e54ebad1df294e76b9f0446a4f1746

    • SHA512

      d0cb9c536b4114803af7480d18f781bed2f0767b4e631c99c68c824dc9126107653b692a88de02b36c431ebc3121e3aed16b58561cff82f77163489512b14ee5

    • SSDEEP

      768:ZtcDoXcZNC30o3fUJlI1U1bp7ii+sNUUW7PId9xW+i1+uBnf:Goi+PzBf

    Score
    1/10
    behavioral26

    • Target

      Rivals of Aether - SteamGG.net/catch_error_mini.dll

    • Size

      5KB

    • MD5

      2a8e268c7e74ced9597ebf21de55e7c2

    • SHA1

      2e5d08450c2b8eb14c3e2ee79450aa7445f37a49

    • SHA256

      01c4b8611ceb00d743462543ff341d3b7b5b14abc8c54fc0cbf8c0e01cd90b79

    • SHA512

      8f1a63817a377b4d3466dface2f6ad2971de196c66b9443d06b037417e98c29f0f8fc7a4858c117446d59a0a00b05975e6a55f2ecdd4237c31ecaf7f76d255bc

    • SSDEEP

      48:SZRn9Oo9jHgpjIEaMHJAxzX1UVQiYQGQpphs8+qxATYeBcPHhyes35gqa70tWplL:e9Z7g1aKJA9WQiYHQvoGeMb

    Score
    3/10
    discovery
    behavioral27

    • Target

      Rivals of Aether - SteamGG.net/execute_shell_simple.dll

    • Size

      75KB

    • MD5

      31fa2a28d6a3bf937e5b40d48351d889

    • SHA1

      517c38765d92860b0fef5d52d8dc119848430677

    • SHA256

      6d1a616f0109886278b6fdc5d8320eb164809e0d23b2326d29218c5edece2445

    • SHA512

      adac0989af8ff6be4d964e7e8be209ecb65737f6e6575ff004c22a434f95b8b6156219314bf98a290b1227ff9861b80ae2c736d8dcbddd1bc0130299ecf9da5f

    • SSDEEP

      1536:NKLawL7agDpi7rwzIHkwgEzuqoFuaC2ZRxsWdKcdb3skjEuJ:NnwL7agDp1zIHfbuqokX2JbckjEuJ

    Score
    3/10
    discovery
    behavioral28

    • Target

      Rivals of Aether - SteamGG.net/gamepad_force_focus.dll

    • Size

      75KB

    • MD5

      a9bf753564e1eb9e51c3b0c7209bfd37

    • SHA1

      8eeb41ec22e125b5a36f6e84acb91d7fc27dd6ce

    • SHA256

      1ac8f9f484ba452d3cca023927f5cca5e00150ce859ccef30aa015cddd0f3706

    • SHA512

      5c885a549e89d1dd398ad54dd0d0a9e62aa74f663916a58a7713dd5db4291f978c014e7930316fee9a6c0128fa3841abf85033e0ed21689fa72cc0bdb29ba932

    • SSDEEP

      1536:sLTsIQPOxdKBpzKLkkcgu6YGZ4FbsW1HcdFOs3c34:q0POxdwzKLbu6YGSF2FOss34

    Score
    3/10
    discovery
    behavioral29

    • Target

      Rivals of Aether - SteamGG.net/gmsched.dll

    • Size

      2KB

    • MD5

      a5ffbb144cfd61f3b220aed9448fd22e

    • SHA1

      bfd14051a66b1a58c42c9098857ca837965b9afc

    • SHA256

      fd720f014ffea6a7a8e2abba67edfc902c73335afc76ada14e6bcab638d727b1

    • SHA512

      528fca6a840766edc9579f858b6c977c32c1a8c2ddddf52f1b324e14de1dc1690e49d8502752f35040de0968678aef01ea2656c0c8f423e3b954a5417d726482

    Score
    3/10
    discovery
    behavioral30

    • Target

      Rivals of Aether - SteamGG.net/steam_api.dll

    • Size

      251KB

    • MD5

      bf1e63a3666be2fe14a0cef933d6b81b

    • SHA1

      c66f1e1a08e782ed3cc6f751d340280ce7828033

    • SHA256

      880a8f88c397ad8e24771cbae2a72374ad8e519d8c72b8b4baf9db04c9ee5ec8

    • SHA512

      67b17b0d9f953d9146148e9ae5cda50a3a5b28cbbb047c07964567917c8dd7064bfb08e6cd93c4a62a46ed5029df863aa7bce95eba2371ffb9bf2d86fe547b2c

    • SSDEEP

      3072:OfAyHIW1tE8y4QC2mCjdi28wwGmEPk2k0trjTsqEixVxjyT+WeAUIICfxetvaoYt:aAyh3E8Gb8wFFPk9ixVxjycCfwtrYt

    Score
    3/10
    discovery
    behavioral31

    • Target

      Rivals of Aether - SteamGG.net/steam_api.of

    • Size

      251KB

    • MD5

      844785d10e81cb5a99da47b73af09489

    • SHA1

      6446e3c75324f2653975657f940cbcf593ec2e51

    • SHA256

      765fb6498ba7d262e63b2dba19c09f63de4dd0a092b5499828ec8949aa183f82

    • SHA512

      f7f38967e8a613a80954bf9b5a92d6c5aa4ecf8c398e4af59dff43fc4969464335e4ec73e94548a69cd1afbb5b485adab2ca5056a2f5890d4ec7f488eee8e860

    • SSDEEP

      3072:OfAyHIW1tE8y4QC2mCjdi28wwGmEPk2k0trjTsqEixVxjyT+WeAUIICfOetvaoYt:aAyh3E8Gb8wFFPk9ixVxjycCfltrYt

    Score
    3/10
    discovery
    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

5
T1547

Registry Run Keys / Startup Folder

5
T1547.001

Event Triggered Execution

3
T1546

Installer Packages

3
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

5
T1547

Registry Run Keys / Startup Folder

5
T1547.001

Event Triggered Execution

3
T1546

Installer Packages

3
T1546.016

Defense Evasion

Modify Registry

5
T1112

System Binary Proxy Execution

3
T1218

Msiexec

3
T1218.007

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

Query Registry

30
T1012

Peripheral Device Discovery

9
T1120

System Information Discovery

19
T1082

Browser Information Discovery

1
T1217

System Location Discovery

28
T1614

System Language Discovery

28
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks

static1

Score
3/10

behavioral1

credential_accessdiscoverymotwpersistencephishingstealer
Score
9/10

behavioral2

Score
1/10

behavioral3

discovery
Score
3/10

behavioral4

Score
1/10

behavioral5

discovery
Score
7/10

behavioral6

discoverypersistence
Score
7/10

behavioral7

discoverypersistenceprivilege_escalation
Score
7/10

behavioral8

discovery
Score
6/10

behavioral9

discoverypersistenceprivilege_escalation
Score
7/10

behavioral10

discoverypersistenceprivilege_escalation
Score
7/10

behavioral11

discovery
Score
7/10

behavioral12

discovery
Score
7/10

behavioral13

discovery
Score
7/10

behavioral14

discovery
Score
7/10

behavioral15

discovery
Score
7/10

behavioral16

discovery
Score
7/10

behavioral17

discovery
Score
7/10

behavioral18

discovery
Score
7/10

behavioral19

discovery
Score
4/10

behavioral20

discovery
Score
4/10

behavioral21

discovery
Score
7/10

behavioral22

discovery
Score
7/10

behavioral23

discovery
Score
7/10

behavioral24

discovery
Score
7/10

behavioral25

Score
6/10

behavioral26

Score
1/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10