Overview

overview

7

Static

static

3

Anime-Best...11.exe

windows7-x64

7

Anime-Best...11.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

Anime-Best.exe

windows7-x64

7

Anime-Best.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

d3dcompiler_47.dll

windows10-2004-x64

3

ffmpeg.dll

windows7-x64

3

ffmpeg.dll

windows10-2004-x64

3

libEGL.dll

windows7-x64

3

libEGL.dll

windows10-2004-x64

3

libGLESv2.dll

windows7-x64

3

libGLESv2.dll

windows10-2004-x64

3

resources/elevate.exe

windows7-x64

3

resources/elevate.exe

windows10-2004-x64

3

swiftshade...GL.dll

windows7-x64

3

swiftshade...GL.dll

windows10-2004-x64

3

swiftshade...v2.dll

windows7-x64

3

swiftshade...v2.dll

windows10-2004-x64

3

vk_swiftshader.dll

windows7-x64

3

vk_swiftshader.dll

windows10-2004-x64

3

vulkan-1.dll

windows7-x64

3

vulkan-1.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-08-2024 15:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Anime-Best.exe

  • Size

    112.4MB

  • MD5

    d2b5925e3739acfa73b78fdc303e67e9

  • SHA1

    2bbc12e73bdd4e95257343e67f246a5865aef42a

  • SHA256

    af46ef0855c8d532e03db49cfe063e241944085c31cdbe79ac66a9e31d79bbb6

  • SHA512

    3c53c1cbbe4880265733447d1ca0f53fb69aa0c7d7a98f36b21a745d425c482d778b175b51ee8b9a8b5802ca8678e9823e4ee14d2acf590db6261d112901f573

  • SSDEEP

    1572864:XzeRomoaC09nEiziYtpg0Ymr7owq3Ddn35FZevY4v034WZZB0HDh996O/fJaCJp:jeRomF3o3V/ZevY/CHHd+Z

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe
    "C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe
      "C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe" --type=gpu-process --field-trial-handle=1624,3452422857740675859,1490558577396017042,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1612 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4872
    • C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe
      "C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,3452422857740675859,1490558577396017042,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=2148 /prefetch:8
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1424
    • C:\Windows\SysWOW64\reg.exe
      C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Anime-Best
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:4784
    • C:\Windows\SysWOW64\reg.exe
      C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Anime-Best /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe\"" /f
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:4048
    • C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe
      "C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe" --type=renderer --field-trial-handle=1624,3452422857740675859,1490558577396017042,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3512
    • C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe
      "C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe" --type=renderer --field-trial-handle=1624,3452422857740675859,1490558577396017042,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4040
    • C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe
      "C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe" --type=renderer --field-trial-handle=1624,3452422857740675859,1490558577396017042,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2988
    • C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe
      "C:\Users\Admin\AppData\Local\Temp\Anime-Best.exe" --type=gpu-process --field-trial-handle=1624,3452422857740675859,1490558577396017042,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2504 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1648
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    1⤵
      PID:4468

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\71cdaaa7-366e-47ee-9826-9e289f0a1f39.tmp
      Filesize

      57B

      MD5

      58127c59cb9e1da127904c341d15372b

      SHA1

      62445484661d8036ce9788baeaba31d204e9a5fc

      SHA256

      be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

      SHA512

      8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\Code Cache\js\index-dir\the-real-index
      Filesize

      240B

      MD5

      344efb40d0ae09ffdd957e5bfcb47b4a

      SHA1

      eece1cce12565fd16f8f12971a22ece66186a89f

      SHA256

      f35bb2f3b7ac7f787314283e38727cd632a3c5a6d68df16a634bfb9d0dbf3c37

      SHA512

      bbf47a58fcab27eb6566c79cf7636e1c30c078b9b748adebff8e27f09ed3d8470f3916b9bfa962a5755de025002fc5f6163d0590141fcef61e9fa658b6949ef8

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\Code Cache\js\index-dir\the-real-index~RFe5851e4.TMP
      Filesize

      48B

      MD5

      7a90d5b9c0e661bff190cfbf4298f986

      SHA1

      42b2adfaf1669236095b20a206a55318a59f3fd5

      SHA256

      a210f694d2615fa0d243340fe318e055dd9f38a012d897f35a42be2960e84f93

      SHA512

      8efe5395b28d92f5121f76ff15435e91b03d0566f8710af8516cda56dfed38e843573e28a0b01b9ef4f83e9c9b6c7d359468d568e6bc6d1e38057a1249c6ae84

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\File System\000\t\Paths\MANIFEST-000001
      Filesize

      41B

      MD5

      5af87dfd673ba2115e2fcf5cfdb727ab

      SHA1

      d5b5bbf396dc291274584ef71f444f420b6056f1

      SHA256

      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

      SHA512

      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\File System\Origins\CURRENT
      Filesize

      16B

      MD5

      46295cac801e5d4857d09837238a6394

      SHA1

      44e0fa1b517dbf802b18faf0785eeea6ac51594b

      SHA256

      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

      SHA512

      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\Network Persistent State
      Filesize

      1KB

      MD5

      857292424deb19edd020b39dd8db538a

      SHA1

      732375a5147b1e6f908b9f22ee2a0c4928853a8e

      SHA256

      eb51d0cbffda363c65c0e37739e27dcb14f2e8ab0bf8eba852df555cbb27d228

      SHA512

      5d1d2845091175512402699dcf89a463d85f6d395275f288ab4d74bb609afa04e71cba0fccea00bb8a9502484d887869f75d38136615fc0c6a4e478b8a4cacda

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\Network Persistent State~RFe58f77a.TMP
      Filesize

      59B

      MD5

      2800881c775077e1c4b6e06bf4676de4

      SHA1

      2873631068c8b3b9495638c865915be822442c8b

      SHA256

      226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

      SHA512

      e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\TransportSecurity
      Filesize

      1KB

      MD5

      ae4ec26206f474de062c23816863ba15

      SHA1

      6f3507ac068439d749ba993fdf1c3f1d0a2384ab

      SHA256

      e21d357c361d61d3e1fdf93433de328583fbbf219122239d2f008448d51fad64

      SHA512

      cd526b8e64211b1c28a4451c4070598cc0ddc602dbe7e61d5586e5d62b9741d00650f486fb39c3c2040c2d0b2f5ea6fd901f5a332a8e3126e8aaa0ab74ce50ac

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\TransportSecurity~RFe586963.TMP
      Filesize

      1KB

      MD5

      0f8b85420f0eeb5449c5d249c53d0a1d

      SHA1

      a606d091d97a3232aff57848eaaf4433c0bcd0fe

      SHA256

      4610bfa904358f8256b466f947d248e68e3ef259d34e0d2d885f066cb6f03c95

      SHA512

      26f6974a4ef853bccf96f21af04c57d16671f3b36a343255461748e6030893047888150049d0c25097517a430e689defaafa29d1fcfb17469f5315b2c4720f30

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\logs\main.log
      Filesize

      1KB

      MD5

      1d8c5a758c0d842171c8f6b6210b221f

      SHA1

      e02e671f13fdc12bfaa8bf0201571422f292f4c4

      SHA256

      d5bda9c2cd7dbdbea61477a6bb0006e0dcc0ec97daba3f647568e73b9bbcc016

      SHA512

      71299c6241f58e65f5f02a43ac9e1ec85a62981b5d89cf29a8da4a83bf0d29b237aa9667573138fea683cec774f28093c27c25fa0ca459676c33a95b726b7328

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\logs\main.log
      Filesize

      1KB

      MD5

      f57a3ac97701f9b6cdcc679810f8844d

      SHA1

      9229df83edbd0dab475625149bbe7e9a6c1fadef

      SHA256

      0d096fe4b4957a8f32ed57c9f255a065936a9f5a5e8fd43aca7dc8ad0da44449

      SHA512

      b5166d274d15c03f9f1df0ddc46768edcf3735fe100f9f3cd79969624ac289adc18b2483f099f8e0643fb335a59dbc4309f035357ab19d9dce61dc31c2fe5d75

      Download Submit

    • C:\Users\Admin\AppData\Roaming\anime-best-app\logs\main.log
      Filesize

      4KB

      MD5

      3d6dea08fab99b13fb4d9b36968d3efb

      SHA1

      ec897dc7d5f0c6bd623b4fef39957d54d17d45bb

      SHA256

      8d820c49b50f1a86534b51dfafbd0457bb2872eafee32f91b1177bbbbb38eab8

      SHA512

      0a0459589ebf214f26e99667234bb4e2636c3e6b006ac5ba7f14fcfe43e68ef20b3d6bb2fe10178cf548a694e8090244bbe0fafff05e3600ed2659cc1c71fdbe

      Download Submit