Overview
overview
3Static
static
3The.Saplin...PC.url
windows7-x64
1The.Saplin...PC.url
windows10-2004-x64
1The.Saplin...ng.exe
windows7-x64
1The.Saplin...ng.exe
windows10-2004-x64
1The.Saplin...ss.dll
windows7-x64
1The.Saplin...ss.dll
windows10-2004-x64
1The.Saplin...rp.dll
windows7-x64
1The.Saplin...rp.dll
windows10-2004-x64
1The.Saplin...ss.dll
windows7-x64
1The.Saplin...ss.dll
windows10-2004-x64
1The.Saplin...pt.dll
windows7-x64
1The.Saplin...pt.dll
windows10-2004-x64
1The.Saplin...ng.dll
windows7-x64
1The.Saplin...ng.dll
windows10-2004-x64
1The.Saplin...ty.dll
windows7-x64
1The.Saplin...ty.dll
windows10-2004-x64
1The.Saplin...re.dll
windows7-x64
1The.Saplin...re.dll
windows10-2004-x64
1The.Saplin...em.dll
windows7-x64
1The.Saplin...em.dll
windows10-2004-x64
1The.Saplin...ng.dll
windows7-x64
1The.Saplin...ng.dll
windows10-2004-x64
1The.Saplin...ne.dll
windows7-x64
1The.Saplin...ne.dll
windows10-2004-x64
1The.Saplin...UI.dll
windows7-x64
1The.Saplin...UI.dll
windows10-2004-x64
1The.Saplin...ne.dll
windows7-x64
1The.Saplin...ne.dll
windows10-2004-x64
1The.Saplin...ng.dll
windows7-x64
1The.Saplin...ng.dll
windows10-2004-x64
1The.Saplin...ib.dll
windows7-x64
1The.Saplin...ib.dll
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
The.Sapling.v11.30/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
The.Sapling.v11.30/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Assembly-CSharp-firstpass.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Assembly-CSharp-firstpass.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Assembly-CSharp.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Assembly-CSharp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Assembly-UnityScript-firstpass.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Assembly-UnityScript-firstpass.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Assembly-UnityScript.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Assembly-UnityScript.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Boo.Lang.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Boo.Lang.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Mono.Security.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/Mono.Security.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/System.Core.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/System.Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityEngine.Networking.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityEngine.Networking.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityEngine.Timeline.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityEngine.Timeline.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityEngine.UI.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityEngine.UI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityEngine.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityEngine.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityScript.Lang.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/UnityScript.Lang.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/mscorlib.dll
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling_Data/Managed/mscorlib.dll
Resource
win10v2004-20240802-en
General
-
Target
The.Sapling.v11.30/The.Sapling.v11.30/the_sapling.exe
-
Size
22.4MB
-
MD5
a55e79e51bf43dec2001efb124a2c1a0
-
SHA1
2585f4c079bd1d0a45ae67c098737b6308e7534b
-
SHA256
40d3819ec4ad62539ebf6d65f55c195f90d7305cb4c51c567f01716e831ef282
-
SHA512
88bf57278c33816ca785202acb7d80d87906e3f8f39ba45c403e7ce39ba6474a22e79fbcdc5d64270d7a886cadc8c585c5157618ba2da4230442e27cfdddfac8
-
SSDEEP
393216:sbIjpwyjlK2m5MM2cf9WPBK53E2vaPvWfpXJu4+Ahze:l2Tu4VN
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2104 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2104 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\The.Sapling.v11.30\The.Sapling.v11.30\the_sapling.exe"C:\Users\Admin\AppData\Local\Temp\The.Sapling.v11.30\The.Sapling.v11.30\the_sapling.exe"1⤵PID:760
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x490 0x3941⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104