d084d509baf552391d065bc19bff16b49a8f371f9dc49480516fecf2e7e1c279

Resubmissions

04/10/2024, 13:28

241004-qqpb5s1akh7

03/10/2024, 22:49

01/10/2024, 17:12

10/09/2024, 12:08

10/09/2024, 12:07

05/09/2024, 12:10

04/09/2024, 23:57

Sharing

Copy URL Twitter E-mail

General

Target
ArenaWars.rar
Size 79.3MB
Sample240905-pcfx6s1eja
SHA256 d084d509baf552391d065bc19bff16b49a8f371f9dc49480516fecf2e7e1c279
MD5 670a64e9555956ac79aa3d1c61af0b95
SHA1 62b47d32abefde25f53423817f9ad8c69dd47986
SHA512 809e59fbc8e49a14012ac7c5a0b1f3e5ca953ee6aba7437a143cde5ce07766d1717f13afa2496bd9dfbc4ef754bff407dbd5aa91eeb72002159da7712ffe78dd
SSDEEP 1572864:41swtDM72L3JYN7Ftrt0Ae/emhpPEDAYOH0U00OgcEgesmurx2A3F:ovmg3JgRMjpPEEYOH0Unsmurgo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  ArenaWarsSetup.exe
- Size 79.2MB
- SHA256 57ee3d6b943838945eb81e1cfff28f891e3ee7edbbaed68b66a7ed31664d4f44
- MD5 3c45f4aac0dc1b32160b5bc77d479599
- SHA1 24b7f26e7404dabf143cc67a4f7591b6ec7275ba
- SHA512 e2a3557a4c39defea8fdf02ba3c807febe965b6deff7047e8a8b0a82a433642f62a7aafae970d2a9b164e3b296e6c30736d722169d469d47eee2a7afe9eaa073
- SSDEEP 1572864:SVQ1RESsuvJ0cTyx9blWjFLLexMA2Ntm6KlFO2KRFaqvv6TIP/Cjtb6hc:SVBkJzux9xWjFLSf/vmDaq3Z/ub1
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

5^/10

discovery
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  ArenaWars.exe
- Size 172.3MB
- SHA256 df78bfcaa3d4092b348fc7935b2d0646e6cee45072153fa6e04ab0bb23adf602
- MD5 e406ee7fc83200a658853b22020dd1dd
- SHA1 1c85386ce34c3f03f306258c25155864fd580e51
- SHA512 446f0b65fc2268d1e0b6edae8200b0074a78b8a6ed97910fc7796cbbf1d22dade503e0191c17e27c73010e4f3175965ba4ae4e8f525c42c94d411b67af2944cf
- SSDEEP 1572864:xvDiRV7iEqRRhCLvfL4j85pyO4C/HTsA5u8/qUw3g4JEZEKLhMPMdQj58mf:PDEflMPMdQt8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d
- MD5 aaea51a605688fcb2f178fd60e4ca64c
- SHA1 69d4791bf3cfedb68bc4d8f766878103578171cb
- SHA512 d328bf2f9ff7372a716a09e5882b9e3c0051b0135412b3258453085db1de2c7699c8aae24edfaca7798f468802db975977c9976e19fca84fffe884bf8594c33e
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1GmfL6k6T6W6r656+eGj/dBIp+:oAZeGLp
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 16261687febd0d707c7b90eeb802b3befdec9b20c4fbd29068540c2b94c81de6
- MD5 74f026c54ba86deb1b4b37bb52ccebb6
- SHA1 760f097ee5a115908644d411ded703d4f8391528
- SHA512 761cc81df52c82e72575737a329a5e56fd443b2a9f2c47159b3b7236453c3931dcdf19f3debc5a9d506c76f1b5f85f8f197ea9da4d15b5a55246316edb07c1a6
- SSDEEP 49152:u1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYw:uJsf83Sn6Ox+tP5w
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 470KB
- SHA256 18cca9a1952e2699a955690b8a870e614c28321a4e032392f8526677b5712f98
- MD5 11dd0e3751c4c8313da6cbc8a5ebc5ee
- SHA1 f86c4e728fe0ba34bd7d8caee5a26b06b410fab6
- SHA512 251d49decca237b2e28f59a58fc4f443970d992a40e1cd7f15ff21630f156c9b05d0ac2a94e0a11bfd9e6488e656f4785c2151e9cad62cd569c4e4cae4c66f23
- SSDEEP 6144:zmi12qlTgeUDsnkcM2nDl83BgENhYCqN8fY24M:zmk2qxgeUDsNnDcgENhYRN8fU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 ce43b08039628c9969345fdf0861f7633faa9a00356173e6c170dc437353a2b3
- MD5 28fb9a36dff35a20393d938be73b0485
- SHA1 9326cec7184c0e90fa9a6523c862a46171e69137
- SHA512 8b1e08e10035ccafbd6c1a145757d9f2c1b57190bb0e4a342fd62017798ed9259264b7ea178db16698c70e50856a1a6381a38248d683756a4e7680b39664c44e
- SSDEEP 98304:MPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:MP4m8TDyluKGugmO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size 224B
- SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- MD5 f0a82a6a6043bf87899114337c67df6c
- SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/binding/napi-v6-win32-unknown-x64/node_sqlite3.node
- Size 1.8MB
- SHA256 7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
- MD5 3072b68e3c226aff39e6782d025f25a8
- SHA1 cf559196d74fa490ac8ce192db222c9f5c5a006a
- SHA512 61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
- SSDEEP 49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
- Size 241B
- SHA256 049b7b1b10417274be6c3e6a9518ac364729354435298d70abf834c35e8f3bf3
- MD5 ff6a0462767c6bf185a566f4aef65ba5
- SHA1 7a3c3ee6748d00fac6e51e366518bb48a41794bb
- SHA512 088d706f5a18323128547b0f126564fb7fa7a36dc8365ee8287663b2cb63da2d02a991bc5cda19af24da2aa063357c25f21347835f9a8aaef341b33bd21127df
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
- Size 6KB
- SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- MD5 275019a4199a84cfd18abd0f1ae497aa
- SHA1 8601683f9b6206e525e4a087a7cca40d07828fd8
- SHA512 6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
- SSDEEP 192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
- Size 1KB
- SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- MD5 e5c2de3c74bc66d4906bb34591859a5f
- SHA1 37ec527d9798d43898108080506126b4146334e7
- SHA512 e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/src/backup.h
- Size 6KB
- SHA256 d3956cdbb650e1ecff8c94fe4e8645f80e10088156d409703c19f186a9c41aa8
- MD5 283f3987e0e65dca1b029bdbb625ccc2
- SHA1 285d7995459c11a47e13834ae3ec0167eacf7d01
- SHA512 ff5c21bd53bf75b33a5430d1abdc8a8649af1535ec02aa5fceb91ed1189e44f0818e25556946d3ad8032b077fa30e73503464aff219b42cbace1ea3f97acb605
- SSDEEP 96:CmRZXeLQSE49p5nLVyWtCP9CPVH0umIXyIyxkdsYPwzrUrmrFrDr9r+Eq2w2BuNl:jXmQS7rRLcxPsPVHXmIXhyxkpPNw0Ik
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32