Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2024 21:39

General

  • Target

    Era.exe

  • Size

    154.5MB

  • MD5

    a6f477bd87c11c97251ffc6864b71a04

  • SHA1

    e840d094feb087139662df38cb28ade6f34497f4

  • SHA256

    a2d406f334dcf42c7f0c8f7cfb4fd5c8ec1babef49f726c97c32faf00477b455

  • SHA512

    d13c51d1900031b636e3ffa2160fc639e40f49528d418416b04b06722f838e02f6944b2ecc168dc4b509e0af2c8918d08592ebd4dacaf22e581b2bebbfe32013

  • SSDEEP

    1572864:GCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:cDAgZi

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Era.exe
    "C:\Users\Admin\AppData\Local\Temp\Era.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Users\Admin\AppData\Local\Temp\binaries\FortniteLauncher.exe
      C:\Users\Admin\AppData\Local\Temp\binaries\FortniteLauncher.exe
      2⤵
        PID:3720
      • C:\Users\Admin\AppData\Local\Temp\Era.exe
        "C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1804,i,9490424284312564623,15528142586102173796,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
          PID:1056
        • C:\Users\Admin\AppData\Local\Temp\Era.exe
          "C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --mojo-platform-channel-handle=1968 --field-trial-handle=1804,i,9490424284312564623,15528142586102173796,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
          2⤵
            PID:1620
          • C:\Users\Admin\AppData\Local\Temp\Era.exe
            "C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --app-user-model-id="Project Era" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2400 --field-trial-handle=1804,i,9490424284312564623,15528142586102173796,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
            2⤵
            • Checks computer location settings
            PID:4776
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed""
            2⤵
              PID:2144
              • C:\Windows\system32\reg.exe
                reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed"
                3⤵
                  PID:4220
              • C:\Users\Admin\AppData\Local\Temp\Era.exe
                "C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 --field-trial-handle=1804,i,9490424284312564623,15528142586102173796,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2276

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\3f2a7e3f-d49a-4346-9c24-41846acd0bdb.tmp.node

              Filesize

              248KB

              MD5

              4a6acbaef4301d3fdcd1c56ba65bfb24

              SHA1

              40589bf8ebd0e65a53cd1bebbe170e9197dde646

              SHA256

              fb214c66c7955ae6737fe7ac0e9cc43e764067a4c8d22c62527f2962b3d341fa

              SHA512

              fff6347ffb2a966522297e73a1a570a6d74975d7037a9956412b5d78823e00555f2095774c190a447295ae3e3480072564a0e49e227ae552412c4afca1d6f316

            • C:\Users\Admin\AppData\Local\Temp\821c23ef-b852-485c-878d-9d034267e8a1.tmp.node

              Filesize

              4.6MB

              MD5

              dc5c055d0e2f4f567c31b179aa348571

              SHA1

              5bc1dcb1665e953e39967a01030bc735a1f9a406

              SHA256

              de469f82ac1f0c09fe7fbc84df34bd0ffaf6f8b22977e396d8cb4f5ce650ac71

              SHA512

              32e1eb2250d59f9512f31195121c55ff22e42de79b84d826bc08be409f2589267ad341c11e77778f0a27630e8db0e28e6a06bd1092f9f08b43994e466888b262

            • C:\Users\Admin\AppData\Roaming\Era\Network\Network Persistent State

              Filesize

              915B

              MD5

              babb772ac1542c232736b40b0cded16b

              SHA1

              2c09941cdf1c41c80c66f31b52f8dadc299ca164

              SHA256

              11d36b09296dc51927551d7d91dd7519e071480d6ff9b80383661842212b0e52

              SHA512

              803669c950f23b3b43470107ddaa384c20200ebad97189f0270a85d2bd603e99eb6cad731cdf7fcab2a39944780d47758037e80c2dc925ba808cda4f45ed05f6

            • C:\Users\Admin\AppData\Roaming\Era\Network\Network Persistent State~RFe589b12.TMP

              Filesize

              59B

              MD5

              2800881c775077e1c4b6e06bf4676de4

              SHA1

              2873631068c8b3b9495638c865915be822442c8b

              SHA256

              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

              SHA512

              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

              Filesize

              2B

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

            • memory/2276-98-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/2276-109-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/2276-108-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/2276-107-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/2276-106-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/2276-105-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/2276-104-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/2276-103-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/2276-99-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/2276-97-0x000001BFC9F60000-0x000001BFC9F61000-memory.dmp

              Filesize

              4KB

            • memory/3720-73-0x0000000000400000-0x0000000000412000-memory.dmp

              Filesize

              72KB

            • memory/4776-57-0x00007FFD24480000-0x00007FFD24481000-memory.dmp

              Filesize

              4KB

            • memory/4776-58-0x00007FFD22A00000-0x00007FFD22A01000-memory.dmp

              Filesize

              4KB