d084d509baf552391d065bc19bff16b49a8f371f9dc49480516fecf2e7e1c279

Target

ArenaWars.rar
Size

79.3MB
Sample

241004-qqpb5s1akh
MD5

670a64e9555956ac79aa3d1c61af0b95
SHA1

62b47d32abefde25f53423817f9ad8c69dd47986
SHA256

d084d509baf552391d065bc19bff16b49a8f371f9dc49480516fecf2e7e1c279
SHA512

809e59fbc8e49a14012ac7c5a0b1f3e5ca953ee6aba7437a143cde5ce07766d1717f13afa2496bd9dfbc4ef754bff407dbd5aa91eeb72002159da7712ffe78dd
SSDEEP

1572864:41swtDM72L3JYN7Ftrt0Ae/emhpPEDAYOH0U00OgcEgesmurx2A3F:ovmg3JgRMjpPEEYOH0Unsmurgo

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  
  ArenaWarsSetup.exe
- Size
  
  79.2MB
- MD5
  
  3c45f4aac0dc1b32160b5bc77d479599
- SHA1
  
  24b7f26e7404dabf143cc67a4f7591b6ec7275ba
- SHA256
  
  57ee3d6b943838945eb81e1cfff28f891e3ee7edbbaed68b66a7ed31664d4f44
- SHA512
  
  e2a3557a4c39defea8fdf02ba3c807febe965b6deff7047e8a8b0a82a433642f62a7aafae970d2a9b164e3b296e6c30736d722169d469d47eee2a7afe9eaa073
- SSDEEP
  
  1572864:SVQ1RESsuvJ0cTyx9blWjFLLexMA2Ntm6KlFO2KRFaqvv6TIP/Cjtb6hc:SVBkJzux9xWjFLSf/vmDaq3Z/ub1
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  ArenaWars.exe
- Size
  
  172.3MB
- MD5
  
  e406ee7fc83200a658853b22020dd1dd
- SHA1
  
  1c85386ce34c3f03f306258c25155864fd580e51
- SHA256
  
  df78bfcaa3d4092b348fc7935b2d0646e6cee45072153fa6e04ab0bb23adf602
- SHA512
  
  446f0b65fc2268d1e0b6edae8200b0074a78b8a6ed97910fc7796cbbf1d22dade503e0191c17e27c73010e4f3175965ba4ae4e8f525c42c94d411b67af2944cf
- SSDEEP
  
  1572864:xvDiRV7iEqRRhCLvfL4j85pyO4C/HTsA5u8/qUw3g4JEZEKLhMPMdQj58mf:PDEflMPMdQt8
Score

1^/10
behavioral11
- Target
  
  LICENSES.chromium.html
- Size
  
  9.0MB
- MD5
  
  aaea51a605688fcb2f178fd60e4ca64c
- SHA1
  
  69d4791bf3cfedb68bc4d8f766878103578171cb
- SHA256
  
  96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d
- SHA512
  
  d328bf2f9ff7372a716a09e5882b9e3c0051b0135412b3258453085db1de2c7699c8aae24edfaca7798f468802db975977c9976e19fca84fffe884bf8594c33e
- SSDEEP
  
  24576:h+QQf6Ox6x5n1nZwReXe1GmfL6k6T6W6r656+eGj/dBIp+:oAZeGLp
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  a7b7470c347f84365ffe1b2072b4f95c
- SHA1
  
  57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA256
  
  af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- SHA512
  
  83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP
  
  49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
Score

1^/10
behavioral14
- Target
  
  ffmpeg.dll
- Size
  
  2.6MB
- MD5
  
  74f026c54ba86deb1b4b37bb52ccebb6
- SHA1
  
  760f097ee5a115908644d411ded703d4f8391528
- SHA256
  
  16261687febd0d707c7b90eeb802b3befdec9b20c4fbd29068540c2b94c81de6
- SHA512
  
  761cc81df52c82e72575737a329a5e56fd443b2a9f2c47159b3b7236453c3931dcdf19f3debc5a9d506c76f1b5f85f8f197ea9da4d15b5a55246316edb07c1a6
- SSDEEP
  
  49152:u1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYw:uJsf83Sn6Ox+tP5w
Score

1^/10
behavioral15
- Target
  
  libEGL.dll
- Size
  
  470KB
- MD5
  
  11dd0e3751c4c8313da6cbc8a5ebc5ee
- SHA1
  
  f86c4e728fe0ba34bd7d8caee5a26b06b410fab6
- SHA256
  
  18cca9a1952e2699a955690b8a870e614c28321a4e032392f8526677b5712f98
- SHA512
  
  251d49decca237b2e28f59a58fc4f443970d992a40e1cd7f15ff21630f156c9b05d0ac2a94e0a11bfd9e6488e656f4785c2151e9cad62cd569c4e4cae4c66f23
- SSDEEP
  
  6144:zmi12qlTgeUDsnkcM2nDl83BgENhYCqN8fY24M:zmk2qxgeUDsNnDcgENhYRN8fU
Score

1^/10
behavioral16
- Target
  
  libGLESv2.dll
- Size
  
  7.7MB
- MD5
  
  28fb9a36dff35a20393d938be73b0485
- SHA1
  
  9326cec7184c0e90fa9a6523c862a46171e69137
- SHA256
  
  ce43b08039628c9969345fdf0861f7633faa9a00356173e6c170dc437353a2b3
- SHA512
  
  8b1e08e10035ccafbd6c1a145757d9f2c1b57190bb0e4a342fd62017798ed9259264b7ea178db16698c70e50856a1a6381a38248d683756a4e7680b39664c44e
- SSDEEP
  
  98304:MPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:MP4m8TDyluKGugmO
Score

1^/10
behavioral17
- Target
  
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size
  
  412B
- MD5
  
  0b33e83d33b01a51625a0fdcbef42ce3
- SHA1
  
  1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA256
  
  a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- SHA512
  
  1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
Score

3^/10

execution
behavioral18 behavioral19
- Target
  
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
- Size
  
  137KB
- MD5
  
  04bfbfec8db966420fe4c7b85ebb506a
- SHA1
  
  939bb742a354a92e1dcd3661a62d69e48030a335
- SHA256
  
  da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- SHA512
  
  4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP
  
  3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
Score

1^/10
behavioral20 behavioral21
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size
  
  224B
- MD5
  
  f0a82a6a6043bf87899114337c67df6c
- SHA1
  
  a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA256
  
  5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- SHA512
  
  d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
Score

3^/10

execution
behavioral22 behavioral23
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/binding/napi-v6-win32-unknown-x64/node_sqlite3.node
- Size
  
  1.8MB
- MD5
  
  3072b68e3c226aff39e6782d025f25a8
- SHA1
  
  cf559196d74fa490ac8ce192db222c9f5c5a006a
- SHA256
  
  7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
- SHA512
  
  61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
- SSDEEP
  
  49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
Score

1^/10
behavioral24 behavioral25
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
- Size
  
  241B
- MD5
  
  ff6a0462767c6bf185a566f4aef65ba5
- SHA1
  
  7a3c3ee6748d00fac6e51e366518bb48a41794bb
- SHA256
  
  049b7b1b10417274be6c3e6a9518ac364729354435298d70abf834c35e8f3bf3
- SHA512
  
  088d706f5a18323128547b0f126564fb7fa7a36dc8365ee8287663b2cb63da2d02a991bc5cda19af24da2aa063357c25f21347835f9a8aaef341b33bd21127df
Score

3^/10

execution
behavioral26 behavioral27
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
- Size
  
  6KB
- MD5
  
  275019a4199a84cfd18abd0f1ae497aa
- SHA1
  
  8601683f9b6206e525e4a087a7cca40d07828fd8
- SHA256
  
  8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- SHA512
  
  6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
- SSDEEP
  
  192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
Score

3^/10

execution
behavioral28 behavioral29
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
- Size
  
  1KB
- MD5
  
  e5c2de3c74bc66d4906bb34591859a5f
- SHA1
  
  37ec527d9798d43898108080506126b4146334e7
- SHA256
  
  d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- SHA512
  
  e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
Score

3^/10

execution
behavioral30 behavioral31
- Target
  
  resources/app.asar.unpacked/node_modules/sqlite3/src/backup.h
- Size
  
  6KB
- MD5
  
  283f3987e0e65dca1b029bdbb625ccc2
- SHA1
  
  285d7995459c11a47e13834ae3ec0167eacf7d01
- SHA256
  
  d3956cdbb650e1ecff8c94fe4e8645f80e10088156d409703c19f186a9c41aa8
- SHA512
  
  ff5c21bd53bf75b33a5430d1abdc8a8649af1535ec02aa5fceb91ed1189e44f0818e25556946d3ad8032b077fa30e73503464aff219b42cbace1ea3f97acb605
- SSDEEP
  
  96:CmRZXeLQSE49p5nLVyWtCP9CPVH0umIXyIyxkdsYPwzrUrmrFrDr9r+Eq2w2BuNl:jXmQS7rRLcxPsPVHXmIXhyxkpPNw0Ik
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32