Analysis

  • max time kernel
    141s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/10/2024, 01:57

General

  • Target

    8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe

  • Size

    2.3MB

  • MD5

    822db8eb88a164fd728c6f95bf2ecd57

  • SHA1

    7cc5bd501e50b83b07ac8672968b72e0b0344fef

  • SHA256

    8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501

  • SHA512

    36039a61a6635de9dcc315db138e48442eb276419a4a065eb88280c7fd9c79708dec502845025fc0fffc688e8e5efa8362b247f3e354d41e6411d985288f5445

  • SSDEEP

    49152:sJpFFF8WhsN7o3owasuJZvjrUXZArwJDKIyeR:sJpF81o3owasuJZvjrUXZAMBKIy

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe
    "C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:276
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\~E31E.bat" -game cstrike -noipx -nojoy -noforcemparms -noforcemaccel"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /fo csv
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2836
        • C:\Windows\SysWOW64\findstr.exe
          FINDSTR /I /C:"CS16Launcher.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2676
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 3
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2732
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /fo csv
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1572
        • C:\Windows\SysWOW64\findstr.exe
          FINDSTR /I /C:"CS16Launcher.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2368
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 3
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1864
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /fo csv
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2896
        • C:\Windows\SysWOW64\findstr.exe
          FINDSTR /I /C:"CS16Launcher.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2884
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 3
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1988
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /fo csv
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2740
        • C:\Windows\SysWOW64\findstr.exe
          FINDSTR /I /C:"CS16Launcher.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1720
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 3
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2628
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 1
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1612
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1036
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1116
      • C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe
        "CS16Launcher.exe" -game cstrike
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2912
        • C:\Users\Admin\AppData\Local\Temp\hl.exe
          "CS16Launcher.exe" -game cstrike
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:908
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3056

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe.New

          Filesize

          219KB

          MD5

          002569d719a892cefdee47b40fb9de9d

          SHA1

          c87baaf1db6f143eafceafb0e10be366a729cff7

          SHA256

          a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746

          SHA512

          00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321

        • C:\Users\Admin\AppData\Local\Temp\Steam.dll

          Filesize

          322KB

          MD5

          94d9e620da6bd5fe5a4d20aebb15ec6d

          SHA1

          3c63d12fd2fda36048461c3a74ef228bb58da61a

          SHA256

          88f7c7fe458ec238599dc57063a69b6417902f1e3591c6239af7c400954f764e

          SHA512

          d1fe188954b45d2db40dcb06b44fb60dfe09fd0e0118ddebb27cb294202c2f59b49009e99d28e200078b22061d48d5b3de6251f255426087337c9fc462a74af7

        • C:\Users\Admin\AppData\Local\Temp\cstrike\valve.rc

          Filesize

          356B

          MD5

          49b89267ce7c9daee488b41c7ecbae66

          SHA1

          8686b5c577bd192e68a5a7bcb5b08c8395d27812

          SHA256

          5b1b2dd68c2ff1fc6cda3f415cfa7087884ca075c371574aa19c1e4474c4d540

          SHA512

          9790a5b972e94f1809f56c73c27d622a3829a182c7710cbbc4c5f9039337d2f498cdadbfe1930b2b20ce450234638e30eef5873a6e10411555c3ce4181a60d47

        • C:\Users\Admin\AppData\Local\Temp\hw.dll

          Filesize

          1.8MB

          MD5

          a0bc2e53bb55121719af9386ac2ff588

          SHA1

          1642aa1bfd63585fb324b8d23806efead856a3c9

          SHA256

          7802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2

          SHA512

          e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92

        • C:\Users\Admin\AppData\Local\Temp\hwpatcher.dll

          Filesize

          69KB

          MD5

          3531565d73be13ffdeabc638d0d32ece

          SHA1

          59e17ec1365012e143b559a5e33ea1792f5264e0

          SHA256

          ad16e56157ceae1169edb1bfa6c902ce85d3f5e23815403d27ccff32efb1a4f2

          SHA512

          5dc99ef4a12f0feb05f78b911fed456cb81470caf011ecdc5b75485b29e3b4025ff9ae6a51870a9752cbd66f13971b06dd74e6c803ede7c5a4dc0371a2d18235

        • C:\Users\Admin\AppData\Local\Temp\mss32.dll

          Filesize

          343KB

          MD5

          f520185e02e8a5d85860669176bc4adc

          SHA1

          cea8e9ff14994c89ad86cf891c89fea42a39250a

          SHA256

          fe62f1eb6ba407df77619d16927abbefad3c726014f6bd1f8c37a7c3d6b781cc

          SHA512

          b434e77a17cdac0109b698d0fccdd25dcdb15090a9fd0427504cc7f616673fa6c7307f07fb22cc2fc1e915887c0f9dc025aa8d38f51503f91df6a9ccee5ebe58

        • C:\Users\Admin\AppData\Local\Temp\platform\config\MasterServers.vdf

          Filesize

          257B

          MD5

          79e8cbef4f9bcae4515d77059f2a5cd4

          SHA1

          29f708d3dd29e1a47837b75c4bd40d95661d563e

          SHA256

          127c6947762873f0056b613de689c6788d64d311cb8d6c48076ca0c9986c173d

          SHA512

          849d7dcea9a2f3adc7204903530c9cc5d254b9e32135dfb0afa070a845f51daccb45f1ff6d145b942e918c51caa1b091ee331b0f2f10fb26fc6b9b888032551b

        • C:\Users\Admin\AppData\Local\Temp\steam_api_c.dll

          Filesize

          68KB

          MD5

          6baefb250616105b06438d6742d1ebde

          SHA1

          bd5b8f0113ab76dd8e35d6c446ab0286450f5666

          SHA256

          02fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753

          SHA512

          4389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45

        • C:\Users\Admin\AppData\Local\Temp\vgui.dll

          Filesize

          344KB

          MD5

          d44ee82601ae62ede3e224269a0bbf53

          SHA1

          2d00b1d5e052584c6c86ec08795d56d2181a91ee

          SHA256

          0d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998

          SHA512

          00dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398

        • C:\Users\Admin\AppData\Local\Temp\~E31E.bat

          Filesize

          1KB

          MD5

          06f5083aa187ad4018d322e79d725e05

          SHA1

          2473e9179f8e68a2a68ccfab0b97eb3335fec55d

          SHA256

          de86746cb9010b0ee4251499d1427d0f59364e7843b2164521b3bf10a9698a23

          SHA512

          406c80a3ba9a6c9ba427f595f3ae9f2253107665c04832431324be035eb58b00e521825a1a964b8a6de94d9297ba18c7e1b7cbf443713058c4561f7ff936264c

        • \Users\Admin\AppData\Local\Temp\FileSystem_Stdio.dll

          Filesize

          116KB

          MD5

          d9c4a776f838733c64331db0c87af459

          SHA1

          480aedeccdf5845de06c7bf39f59783a8fe92b1a

          SHA256

          4f7dca9537cdf20b65da599ffc33ea69e8a132239cfb6a3d0b1b623359dcda85

          SHA512

          5996c9a5cc5bc459b4dcdd7961690cbefdb741dd19338bfb4d1a864ce265e623f4e204dc6f1d4b0b84e66d0ae2f56b4f9bdb3cd7355f8a450703d0a2614d8d82

        • \Users\Admin\AppData\Local\Temp\hl.exe

          Filesize

          84KB

          MD5

          2098ccf443433129b556c2849fe99e26

          SHA1

          074ddbaff48c88b3b5c8f881c35d2be2bb19a249

          SHA256

          4a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af

          SHA512

          fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10

        • \Users\Admin\AppData\Local\Temp\uklUcicY.dat

          Filesize

          40KB

          MD5

          e1cd35bbc28f73b7481e8835ee0f0b13

          SHA1

          ef40d489c61b178b54f8116548662ee876e0133f

          SHA256

          6ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf

          SHA512

          baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3

        • memory/276-25-0x0000000000400000-0x0000000000646000-memory.dmp

          Filesize

          2.3MB

        • memory/276-26-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/276-0-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/276-194-0x0000000000400000-0x0000000000646000-memory.dmp

          Filesize

          2.3MB

        • memory/908-182-0x0000000000280000-0x0000000000295000-memory.dmp

          Filesize

          84KB

        • memory/908-185-0x00000000002B0000-0x00000000002BF000-memory.dmp

          Filesize

          60KB

        • memory/908-174-0x00000000009C0000-0x0000000000A18000-memory.dmp

          Filesize

          352KB

        • memory/908-191-0x0000000004920000-0x0000000005B4A000-memory.dmp

          Filesize

          18.2MB

        • memory/908-192-0x0000000004920000-0x0000000005B4A000-memory.dmp

          Filesize

          18.2MB