Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 04:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
The Long Dark V1.33 Trainer +12 MrAntiFun.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
The Long Dark V1.33 Trainer +12 MrAntiFun.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
The Long Dark V1.33 Trainer +12 MrAntiFun.exe
-
Size
4.7MB
-
MD5
1504b25a090df72c2f593a9a54cd9075
-
SHA1
fb433c5724f7e7118dc055598becd0423c2a8e22
-
SHA256
469884502e03105881b8688fb028c04ef006b1d3f542f2824c520f8001c7c791
-
SHA512
664bb1749159645ff5544f605a5ae0afde406ec409ce348c1084de14f7b2641c4b8d1ba0b7a518906fdcb4edcb05d8eda7c463574bf9e918b772a62e51e58aa0
-
SSDEEP
98304:b10sCeZfmNLOTr05dA8ajPMw3PM7SqJLpPhHGqKk5EdREb:b10sCerP0vFaJE7Sq5pPhHrx8REb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3492 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe -
Loads dropped DLL 2 IoCs
pid Process 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe -
Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\GLU32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\Wldp.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\KERNELBASE.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\comdlg32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\wsock32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\bcryptPrimitives.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\MSCTF.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\TextShaping.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\ucrtbase.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\gdi32full.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\wininet.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\uxtheme.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\ntdll.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\msvcrt.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\SHLWAPI.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\shcore.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\imm32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\psapi.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\ole32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\winmm.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\apphelp.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\RPCRT4.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\GDI32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\sechost.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\shell32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\version.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\opengl32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\clbcatq.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\KERNEL32.DLL The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\msvcp_win.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\combase.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\explorerframe.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\shfolder.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\windows.storage.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\hhctrl.ocx The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\msimg32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\kernel.appcore.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\PROPSYS.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\user32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\advapi32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\ws2_32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\profapi.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\oleaut32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\win32u.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe File opened for modification C:\Windows\SysWOW64\imagehlp.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll The Long Dark V1.33 Trainer +12 MrAntiFun.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language The Long Dark V1.33 Trainer +12 MrAntiFun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language The Long Dark V1.33 Trainer +12 MrAntiFun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language The Long Dark V1.33 Trainer +12 MrAntiFun.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeTcbPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeTcbPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeLoadDriverPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeCreateGlobalPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: 33 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeSecurityPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeTakeOwnershipPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeManageVolumePrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeBackupPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeCreatePagefilePrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeShutdownPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeRestorePrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: 33 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe Token: SeIncBasePriorityPrivilege 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3364 The Long Dark V1.33 Trainer +12 MrAntiFun.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3584 wrote to memory of 3492 3584 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 91 PID 3584 wrote to memory of 3492 3584 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 91 PID 3584 wrote to memory of 3492 3584 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 91 PID 3492 wrote to memory of 3364 3492 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 92 PID 3492 wrote to memory of 3364 3492 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 92 PID 3492 wrote to memory of 3364 3492 The Long Dark V1.33 Trainer +12 MrAntiFun.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\The Long Dark V1.33 Trainer +12 MrAntiFun.exe"C:\Users\Admin\AppData\Local\Temp\The Long Dark V1.33 Trainer +12 MrAntiFun.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3DFE.tmp\The Long Dark V1.33 Trainer +12 MrAntiFun.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3DFE.tmp\The Long Dark V1.33 Trainer +12 MrAntiFun.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3DFE.tmp\extracted\The Long Dark V1.33 Trainer +12 MrAntiFun.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3DFE.tmp\extracted\The Long Dark V1.33 Trainer +12 MrAntiFun.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3DFE.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3364
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:81⤵PID:4160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5853464611f53cd8a54be4c2b5623eb6e
SHA1b185b55efbe96a4797169b3547c8b50ec357dbc2
SHA256012a6f7575c1dd98811f1db0ee72bdd4eff1a0873fc94b38d7d4261c12399e02
SHA5121e42642200f269fbc7bef1804bb1e2144c9b08c36ed168f060400b9f34881c263f41061dbe112e52b031b9163f11e4666301f9bf533666d1b6f30cb9370b3a3e
-
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3DFE.tmp\The Long Dark V1.33 Trainer +12 MrAntiFun.exe
Filesize193KB
MD56852660b8cbb67ee3f1e31bf2f1e0afd
SHA1c1b790e062f3a13d3e2f90c58e92ded585abbe3b
SHA256cd86234cf14dfc0e66ae9e575326fd0cf74723a5a60337f7079c0540b6da5c8b
SHA5125722ebf6bef799721464094c6d6a81931bf8f78bdd1fbe12b153cf7b0e4e9e7307fa7a01e0cc16ce885c20c3a0a3cc95d6a7d86413f0c61cca3450fa565dd6a8
-
Filesize
650KB
MD562261aff731f1dde9ca637d8693d72e6
SHA1e9cd861589abe6cbeaae164cc1944c1f965612c0
SHA2560966721b62041c8bdd443d6bc9de8b89971667678eb9de5e7d14423aea7a2276
SHA512d6b6a7502500204671c547fc4270d5125d16efe4e1dd23b734c3c7a4a9b71034e5bad17bd099228745f5dc4f11c2441ea44a938aa4a1d0768744a7679d74d748
-
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3DFE.tmp\extracted\The Long Dark V1.33 Trainer +12 MrAntiFun.exe
Filesize7.6MB
MD57fd341bc6d65a263627def33b1657a1a
SHA18e3978836fddb530e14126dab75ac58289cb2060
SHA256fb416f9301c9528ee3fed2a5af3b209c0a7f2fa710198f9c07ab8ee96a4cfa96
SHA512a34ddcbb7ff014127087f83f0150b76de0bb152d6817434a4ab5740c066938c58f774954f05792632edfda2dab888dca997bc8ceb167ff259fe3d26c34c7d5b6
-
Filesize
5KB
MD51dc41a0a351e745085fcc98a3933d91f
SHA1bf1e7d333e6d7b3d4bfe5cdcada19af1931dbe15
SHA256a2e02dd32f0245ff31190288b368b3efbbe7c48a95dd22c321231c2f46597d9b
SHA51276f171411d028e72613859332f381f8f26e85d1844c143a8888e4937ca72d7b38ffe66ce617eee5e8155ba034dcc559a9417b5def056bb74227b9bae392d1440
-
Filesize
491KB
MD5c8f47a0e750e07d86a47b3296fb59a97
SHA11f894c9aa88dd2448e50ab5e7277cd4b4c629c6d
SHA256dcfd91f21dee9e70179337a85d21b3ca925f1a6c21de9576aa5219732b7c7a86
SHA512e154a097e8e174a47fea76c96d1c27d93cf9bfbdc47eeef56486cc3d2e661649a1d7da5cfe0ce220ea172f4646ab4eecbd2e1594011d0a8ca1eb416cd84b8b2a
-
Filesize
1.2MB
MD59139604740814e53298a5e8428ba29d7
SHA1c7bf8947e9276a311c4807ea4a57b504f95703c9
SHA256150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f
SHA5120b99259e9c0ee566d55cc53c4a7eabf025ed95973edc80ded594023a33f8273cd5d3f3053993f771f9db8a9d234e988cba73845c19ddc6e629e15a243c54cd5d