f578d77e5264494fd9cf4b740953b12b348745c43cc256cc5339c6a91413f909

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lcb spoofer_updated_quack/cleaners/leakedshit/eac install/EAC.bat
Size

68B
MD5

8e25b700f094c22cf9545b24df4b3b98
SHA1

58bd8197a3b4f1e687179b0c611a4db3869004ef
SHA256

5a98534f6de39af620b6520d25ac388d1ee46f10d10c7a05f34f6593098c99d7
SHA512

2712e9e9b08dcd00eef9504bcafb45e92554240ab8dd7033483305ad1eddae9b60f7577bca987ddc7c4ad4762467e596ecef6dac2502b0c3e3f2f1870fb0b898

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe	EasyAntiCheat_EOS_Setup.exe
File created	C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe	EasyAntiCheat_EOS_Setup.exe
File opened for modification	C:\Program Files (x86)\EasyAntiCheat_EOS	EasyAntiCheat_EOS_Setup.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EasyAntiCheat_EOS_Setup.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2128	EasyAntiCheat_EOS_Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2128	2948	cmd.exe	31
PID 2948 wrote to memory of 2128	2948	cmd.exe	31
PID 2948 wrote to memory of 2128	2948	cmd.exe	31
PID 2948 wrote to memory of 2128	2948	cmd.exe	31
PID 2948 wrote to memory of 2128	2948	cmd.exe	31
PID 2948 wrote to memory of 2128	2948	cmd.exe	31
PID 2948 wrote to memory of 2128	2948	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\lcb spoofer_updated_quack\cleaners\leakedshit\eac install\EAC.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\lcb spoofer_updated_quack\cleaners\leakedshit\eac install\EasyAntiCheat_EOS_Setup.exe
  EasyAntiCheat_EOS_Setup.exe install a4a57ff548934dbeba0cc7c62cdf9f34
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads