Overview
overview
7Static
static
3Cheat-Master.ru.exe
windows7-x64
3Cheat-Master.ru.exe
windows10-2004-x64
3mod_sa for...g).exe
windows7-x64
7mod_sa for...g).exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...od.dll
windows7-x64
3$PLUGINSDI...od.dll
windows10-2004-x64
3$PLUGINSDI...rl.dll
windows7-x64
3$PLUGINSDI...rl.dll
windows10-2004-x64
3$PLUGINSDI...og.dll
windows7-x64
3$PLUGINSDI...og.dll
windows10-2004-x64
3$PLUGINSDI...up.exe
windows7-x64
7$PLUGINSDI...up.exe
windows10-2004-x64
7Uninstall_...CM.exe
windows7-x64
7Uninstall_...CM.exe
windows10-2004-x64
7d3d9.dll
windows7-x64
3d3d9.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
Cheat-Master.ru.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Cheat-Master.ru.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(eng).exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(eng).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/bassmod.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/bassmod.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/brandingurl.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/brandingurl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/dumplog.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/dumplog.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/dxwebsetup.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/dxwebsetup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Uninstall_mod_sa for CM.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Uninstall_mod_sa for CM.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
d3d9.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
d3d9.dll
Resource
win10v2004-20240802-en
General
-
Target
mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(eng).exe
-
Size
729KB
-
MD5
19b0377c359dc2ca1cb1f81465a72585
-
SHA1
8bf20592025291567b35700d29578da6a3734439
-
SHA256
6244a72779d2c3619b95292a881837876288697b64c7bcd0571acdde28d153b2
-
SHA512
9f9890b6053d1eaabefbc2af39ec19b3802d1178459442d9b5104410ce5375a613aee112c08b1e3ca0b342a28226be5c067215eaca0b44c5aecb1692fed1c7f3
-
SSDEEP
12288:er/6zp1WktZNeCjEkn65ZzxT4AJa44/lseFlKZpWyt4Noyqwug2aRA0+fKU1dJpB:mGp1f9ew3uVqAJarHTA5coy7tmPbdJOq
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2688 mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(eng).exe 2688 mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(eng).exe 2688 mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(eng).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(eng).exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD54c0c6163b636f627e0d505deda672c90
SHA12eae4e6f00673a03ae2434f1b22dc9218e4761a8
SHA256bea71368433f91e32c597db990089ecb7599879f76a64f7f3446489578b2d5fb
SHA512e817ad35f0e89ecce9d73add641d9eab95de6c6c30153e594673c8e0243e738a31dfb872cc76a8d51bc513775fc1dabc9adb65019298048539d6c3aa7d33e2ef
-
Filesize
33KB
MD5e4ec57e8508c5c4040383ebe6d367928
SHA1b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA2568ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA51277d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
-
Filesize
3KB
MD5028857ee4bf29e5379b19027df010071
SHA18cba90942b3ea405f70e4ae899bb08f7b58dfe70
SHA256798ce85390508959953b55d966ee3ad8fae938cb107233876566a5823d339a66
SHA512e08d91f53039a1ec0c768a873b91901cae3fa7b91f368157c3adca12cb439b627e9d4558b49d747ef7fe6250a51693183ca29422603bf102bee05aa410539b8c