Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2024 14:17

General

  • Target

    Era.exe

  • Size

    154.5MB

  • MD5

    a6f477bd87c11c97251ffc6864b71a04

  • SHA1

    e840d094feb087139662df38cb28ade6f34497f4

  • SHA256

    a2d406f334dcf42c7f0c8f7cfb4fd5c8ec1babef49f726c97c32faf00477b455

  • SHA512

    d13c51d1900031b636e3ffa2160fc639e40f49528d418416b04b06722f838e02f6944b2ecc168dc4b509e0af2c8918d08592ebd4dacaf22e581b2bebbfe32013

  • SSDEEP

    1572864:GCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:cDAgZi

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Era.exe
    "C:\Users\Admin\AppData\Local\Temp\Era.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Users\Admin\AppData\Local\Temp\binaries\FortniteLauncher.exe
      C:\Users\Admin\AppData\Local\Temp\binaries\FortniteLauncher.exe
      2⤵
        PID:3180
      • C:\Users\Admin\AppData\Local\Temp\Era.exe
        "C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1752,i,2713152297491209953,15071555629836662058,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
          PID:1688
        • C:\Users\Admin\AppData\Local\Temp\Era.exe
          "C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --mojo-platform-channel-handle=1976 --field-trial-handle=1752,i,2713152297491209953,15071555629836662058,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
          2⤵
            PID:2588
          • C:\Users\Admin\AppData\Local\Temp\Era.exe
            "C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --app-user-model-id="Project Era" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2368 --field-trial-handle=1752,i,2713152297491209953,15071555629836662058,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
            2⤵
            • Checks computer location settings
            PID:4868
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed""
            2⤵
              PID:3756
              • C:\Windows\system32\reg.exe
                reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed"
                3⤵
                  PID:3616
              • C:\Users\Admin\AppData\Local\Temp\Era.exe
                "C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3144 --field-trial-handle=1752,i,2713152297491209953,15071555629836662058,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3172

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\a00de547-bdb9-4493-9598-502487fbd1c5.tmp.node

              Filesize

              248KB

              MD5

              4a6acbaef4301d3fdcd1c56ba65bfb24

              SHA1

              40589bf8ebd0e65a53cd1bebbe170e9197dde646

              SHA256

              fb214c66c7955ae6737fe7ac0e9cc43e764067a4c8d22c62527f2962b3d341fa

              SHA512

              fff6347ffb2a966522297e73a1a570a6d74975d7037a9956412b5d78823e00555f2095774c190a447295ae3e3480072564a0e49e227ae552412c4afca1d6f316

            • C:\Users\Admin\AppData\Local\Temp\bb3935b9-73da-4555-ac49-8d5b8c20e3fd.tmp.node

              Filesize

              4.6MB

              MD5

              dc5c055d0e2f4f567c31b179aa348571

              SHA1

              5bc1dcb1665e953e39967a01030bc735a1f9a406

              SHA256

              de469f82ac1f0c09fe7fbc84df34bd0ffaf6f8b22977e396d8cb4f5ce650ac71

              SHA512

              32e1eb2250d59f9512f31195121c55ff22e42de79b84d826bc08be409f2589267ad341c11e77778f0a27630e8db0e28e6a06bd1092f9f08b43994e466888b262

            • C:\Users\Admin\AppData\Roaming\Era\Network\Network Persistent State

              Filesize

              915B

              MD5

              71247d32b743e8f50b06d9695178a98b

              SHA1

              5ed5fc35a7bd4af7c17fce8c495fec289481eeb7

              SHA256

              13d84d790c2a82eb6da580052daee9060a2a9de686660914799a58d00bee0329

              SHA512

              f5d3e50c85fac5dfa4160b83112f04494dfd80b5eada4bfe40f422e635fc15062435f139c0398b15b9ce60b9c8e0913cf3a8be6f050fd9e1f99e01c78b09336c

            • C:\Users\Admin\AppData\Roaming\Era\Network\Network Persistent State~RFe58aef8.TMP

              Filesize

              59B

              MD5

              2800881c775077e1c4b6e06bf4676de4

              SHA1

              2873631068c8b3b9495638c865915be822442c8b

              SHA256

              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

              SHA512

              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

              Filesize

              2B

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

            • memory/3172-105-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3172-109-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3172-108-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3172-107-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3172-106-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3172-104-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3172-103-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3172-99-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3172-97-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3172-98-0x00000226A0B30000-0x00000226A0B31000-memory.dmp

              Filesize

              4KB

            • memory/3180-73-0x0000000000400000-0x0000000000412000-memory.dmp

              Filesize

              72KB

            • memory/4868-58-0x00007FFE14BA0000-0x00007FFE14BA1000-memory.dmp

              Filesize

              4KB

            • memory/4868-57-0x00007FFE15830000-0x00007FFE15831000-memory.dmp

              Filesize

              4KB