9bf4cc19f23e05dce60fa4c0cb8616edd69ad71b32cc2005c5112aa13f54762c

Analysis

max time kernel
13s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
31-08-2024 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hypnotic Idol v1.014 - SteamGG.net/_Redist/oalinst.exe
Size

790KB
MD5

694f54bd227916b89fc3eb1db53f0685
SHA1

21fdc367291bbef14dac27925cae698d3928eead
SHA256

b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
SHA512

55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
SSDEEP

12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 8 IoCs

Processes:

oalinst.exe

pid process

1148 oalinst.exe
1148 oalinst.exe
1148 oalinst.exe
1148 oalinst.exe
1148 oalinst.exe
1148 oalinst.exe
1148 oalinst.exe
1148 oalinst.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1148	oalinst.exe
1148	oalinst.exe
1148	oalinst.exe
1148	oalinst.exe
1148	oalinst.exe
1148	oalinst.exe
1148	oalinst.exe
1148	oalinst.exe

Drops file in System32 directory 6 IoCs

Processes:

oalinst.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\tmp3E68.tmp	oalinst.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	oalinst.exe
File created	C:\Windows\SysWOW64\wrap_oal.new	oalinst.exe
File created	C:\Windows\system32\OpenAL32.new	oalinst.exe
File created	C:\Windows\system32\wrap_oal.new	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\tmp3E67.tmp	oalinst.exe

Drops file in Program Files directory 1 IoCs

Processes:

oalinst.exe

description ioc process

File created C:\Program Files (x86)\OpenAL\oalinst.exe oalinst.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

oalinst.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oalinst.exe

description	ioc	process
File created	C:\Program Files (x86)\OpenAL\oalinst.exe	oalinst.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oalinst.exe

C:\Users\Admin\AppData\Local\Temp\Hypnotic Idol v1.014 - SteamGG.net\_Redist\oalinst.exe
"C:\Users\Admin\AppData\Local\Temp\Hypnotic Idol v1.014 - SteamGG.net\_Redist\oalinst.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1148

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\OpenAL32.new
Filesize
106KB

MD5
235355a8dd26903e75d5e812ecf50e53

SHA1
8316319341a0f9054e19e4a7b21df3dc49386fee

SHA256
1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd

SHA512
5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac

Download Submit
\Windows\SysWOW64\wrap_oal.new
Filesize
434KB

MD5
d494267bc169604fac5e3679b9a97fed

SHA1
c093ce5a4f7dc40f7f604945bd1facfb2c805c4b

SHA256
a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f

SHA512
7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040

Download Submit
\Windows\System32\OpenAL32.new
Filesize
120KB

MD5
2ad7b4f3c8d2bb686d231edff404b7a4

SHA1
f29676b96d04bd2765925a3834d9babfdce6a0b3

SHA256
87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039

SHA512
51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528

Download Submit
\Windows\System32\wrap_oal.new
Filesize
455KB

MD5
549347bcd4aacd63243d78e8f869dbb1

SHA1
efc00d2a7c5acfe17b8a58023826e6840aef39a6

SHA256
5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909

SHA512
c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5

Download Submit