Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 20:14

General

  • Target

    PAYDAY3_Trainer_[unknowncheats.me]_.exe

  • Size

    7.0MB

  • MD5

    1e15df4e8bd6c1f0b0b09a3796f389c9

  • SHA1

    f504549f0c3497f2362cdf682e6604574a17afcc

  • SHA256

    d48fa25aa43ffa59b29b8219de34a5421e620242d22bdcb831ca0c2210ec8e72

  • SHA512

    0052eae352d27dc6b93f8fe7b3a224b6386f17e23dcb43b52109fe61e4cfe8279f2be23403eeffd63cd029a24492f24f84728bcd3c07ff23f1482ba456b6885c

  • SSDEEP

    98304:j+uiK85v5TFh7KgHallQ8MxjDttS+2gA17bliqxIY/EC4hKDzhVVVVVV3sFWLG6q:j+uiKsvDhO5M5BtQXliqxIEpEWitmm1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 51 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PAYDAY3_Trainer_[unknowncheats.me]_.exe
    "C:\Users\Admin\AppData\Local\Temp\PAYDAY3_Trainer_[unknowncheats.me]_.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\PAYDAY3_Trainer_[unknowncheats.me]_.exe
      "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\PAYDAY3_Trainer_[unknowncheats.me]_.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\extracted\PAYDAY3_Trainer_[unknowncheats.me]_.exe
        C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\extracted\PAYDAY3_Trainer_[unknowncheats.me]_.exe "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2828
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:532
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1092

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\CET_Archive.dat

            Filesize

            6.7MB

            MD5

            596b20865af108f27ec9e8107bdf240e

            SHA1

            a839323bf74236e707e5ae6b1d7907599d5d38a0

            SHA256

            f302cc69ca61b0c1d0f97d18b01ea9eaeb89a9586a35be92e0ac997b1b8ad270

            SHA512

            f3ec4c57e6a82b478f60f5df2a8ba002e426316084ac8122f48dba6b2438bf4f32822430dca69a81e8d8a6627d6ac07ed86b07371dd4dff754a2411905941a18

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\extracted\CET_TRAINER.CETRAINER

            Filesize

            458KB

            MD5

            64cefcb99b2b731cd8762d33c14ac102

            SHA1

            69548d28c32599b99e8949e68e70074e795a7d8b

            SHA256

            34994d2729e94c0e47f0301377bd82d43ef45faaed1f5f07db2e152978fbedd8

            SHA512

            e5b2eb2dfb199b588d790ece5a17bc52380eb37079008c61aefd4674f98f0617b8116e3549eae7dd4537548a5ffc10d67effd1bd1a1e1998d6188eebfdeb226f

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\extracted\PAYDAY3_Trainer_[unknowncheats.me]_.exe

            Filesize

            15.9MB

            MD5

            edeef697cbf212b5ecfcd9c1d9a8803d

            SHA1

            e90585899ae4b4385a6d0bf43c516c122e7883e2

            SHA256

            ac9bcc7813c0063bdcd36d8e4e79a59b22f6e95c2d74c65a4249c7d5319ae3f6

            SHA512

            1aaa8fc2f9fafecbe88abf07fbc97dc03a7c68cc1d870513e921bf3caeaa97128583293bf5078a69aecbb93bf1e531605b36bd756984db8d703784627d1877d1

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\extracted\defines.lua

            Filesize

            12KB

            MD5

            62e1fa241d417668f7c5da6e4009a5a6

            SHA1

            f887409e3c204a87731f317a999dc7e4cc8d3fcd

            SHA256

            82e8ef7df20a86791cef062f2dcacb1d91b4adc9f5dea2fd274886be8365b2f8

            SHA512

            2283cbb9e1d5d53ad1ed9bc9db6034fb3c53c633b11001f373523640bbbba95da9a3a0866c7d5fa0620facab7d18c8577dfd69496fc7319e0a4a74d0b9e10c45

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\extracted\lua53-64.dll

            Filesize

            528KB

            MD5

            b7c9f1e7e640f1a034be84af86970d45

            SHA1

            f795dc3d781b9578a96c92658b9f95806fc9bdde

            SHA256

            6d0a06b90213f082cb98950890518c0f08b9fc16dbfab34d400267cb6cdadeff

            SHA512

            da63992b68f1112c0d6b33e6004f38e85b3c3e251e0d5457cd63804a49c5aa05aa23249e0614dacad4fec28ca6efdb5ddee06da5bfbfa07e21942976201079f3

          • \Users\Admin\AppData\Local\Temp\cetrainers\CET41B2.tmp\PAYDAY3_Trainer_[unknowncheats.me]_.exe

            Filesize

            225KB

            MD5

            971b37cedf686e0ac8ca0297a953aad9

            SHA1

            8ea777fa6c70a619d4e92cc6435c4eba2b16a23e

            SHA256

            1965546a19990b4523a1588eb0d7fdd42bd443e2bcc632dae04343d358394ae7

            SHA512

            2f0f3facf2587b751bb658eaab9ca1536d7326956b0eeca7bd0badc893c0878741f8bb56d8c1e360f2cb4bd9442866bd9faf7bdec7d02105f6c149640cf180d8