Analysis

  • max time kernel
    8s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    31-08-2024 00:16

General

  • Target

    Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2013_x86.exe

  • Size

    6.2MB

  • MD5

    38a1b890ce847167d16567cf7b7a5642

  • SHA1

    0f5d66bcaf120f2d3f340e448a268fe4bbf7709d

  • SHA256

    53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd

  • SHA512

    907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd

  • SSDEEP

    196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hypnotic Idol v1.014 - SteamGG.net\_Redist\vcredist2013_x86.exe
    "C:\Users\Admin\AppData\Local\Temp\Hypnotic Idol v1.014 - SteamGG.net\_Redist\vcredist2013_x86.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\Hypnotic Idol v1.014 - SteamGG.net\_Redist\vcredist2013_x86.exe
      "C:\Users\Admin\AppData\Local\Temp\Hypnotic Idol v1.014 - SteamGG.net\_Redist\vcredist2013_x86.exe" -burn.unelevated BurnPipe.{270EA813-E33E-4392-B846-80FBC8526800} {86C337A0-251E-49CC-AD9C-DB2689D49593} 3064
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\logo.png

    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • \Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\wixstdba.dll

    Filesize

    117KB

    MD5

    a52e5220efb60813b31a82d101a97dcb

    SHA1

    56e16e4df0944cb07e73a01301886644f062d79b

    SHA256

    e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

    SHA512

    d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e