61557808e53020df74f9c70fca58c3a19d4c5b32aeb0090e40634e803c3f15be

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

steam_player.exe
Size

9KB
MD5

9fdcca7e435ba1e54cc74c073485fcf7
SHA1

6dfe870a9a824ceac640eed7b4c741ab804cab18
SHA256

61557808e53020df74f9c70fca58c3a19d4c5b32aeb0090e40634e803c3f15be
SHA512

3c893d0c4b7cfe80c2b35160195c81dda7cfa8a8404cd901e5abf2dd6f218992c2a8816744c2ef3a0be30eb2f584f049ac1e233ad08a4cf3bb284355622863c9
SSDEEP

192:vBm7CDjfINOPXqUXwuA08stYcFkVc03KY:vLfINUXqluA0ptYcFkVc03K

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2380	netstat.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2396	steam_player.exe
2396	steam_player.exe
2396	steam_player.exe
2396	steam_player.exe
2396	steam_player.exe
2396	steam_player.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	netstat.exe
Token: SeDebugPrivilege	2396	steam_player.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2380	2396	steam_player.exe	31
PID 2396 wrote to memory of 2380	2396	steam_player.exe	31
PID 2396 wrote to memory of 2380	2396	steam_player.exe	31

C:\Users\Admin\AppData\Local\Temp\steam_player.exe
"C:\Users\Admin\AppData\Local\Temp\steam_player.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\netstat.exe
  "netstat" -n -a -o
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/2396-1-0x000000013F1A0000-0x000000013F1A6000-memory.dmp

Filesize
24KB

Download
memory/2396-2-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download