Overview
overview
10Static
static
10133Devbloc...31.exe
windows7-x64
10133Devbloc...31.exe
windows10-2004-x64
10133Devbloc...ME.dll
windows7-x64
1133Devbloc...ME.dll
windows10-2004-x64
1133Devbloc...v2.dll
windows7-x64
1133Devbloc...v2.dll
windows10-2004-x64
1133Devbloc...3s.dll
windows7-x64
3133Devbloc...3s.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 16:17
Behavioral task
behavioral1
Sample
133Devblock cheat/Extreme Injector v2 by master131.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
133Devblock cheat/Extreme Injector v2 by master131.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
133Devblock cheat/UInjectIME.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
133Devblock cheat/UInjectIME.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
133Devblock cheat/UnityLoaderv2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
133Devblock cheat/UnityLoaderv2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
133Devblock cheat/hax3s.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
133Devblock cheat/hax3s.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
133Devblock cheat/Extreme Injector v2 by master131.exe
-
Size
865KB
-
MD5
4e49565cbd3e2a63b3ade2b8532ec912
-
SHA1
0092c941f2432f597a663b1fa627764c732de1e6
-
SHA256
8d595ae8374459d800de2f9ccbf5eba2136e005168489cf7d07fc97eefd54077
-
SHA512
973d4ccc99be60d48d05dbe5b54307480d846a9db86a65e766a0640e5db54a1eabe55b3ee6767f9c63bfc63c5c0463dd89e00d5431a28d294f28da52ee7d1d39
-
SSDEEP
12288:YTKa4lZWCw0K9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFX:YyZtGiBIGkbxqEcjsWiDxguehC2SA
Malware Config
Signatures
-
Darkcomet family
-
Executes dropped EXE 2 IoCs
Processes:
Extreme Injector v2 by master131.exe563465.exepid Process 2148 Extreme Injector v2 by master131.exe 2368 563465.exe -
Loads dropped DLL 3 IoCs
Processes:
Extreme Injector v2 by master131.exepid Process 2404 Extreme Injector v2 by master131.exe 2404 Extreme Injector v2 by master131.exe 2404 Extreme Injector v2 by master131.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
563465.exeExtreme Injector v2 by master131.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 563465.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extreme Injector v2 by master131.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Extreme Injector v2 by master131.exepid Process 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe 2148 Extreme Injector v2 by master131.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
563465.exeExtreme Injector v2 by master131.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2368 563465.exe Token: SeSecurityPrivilege 2368 563465.exe Token: SeTakeOwnershipPrivilege 2368 563465.exe Token: SeLoadDriverPrivilege 2368 563465.exe Token: SeSystemProfilePrivilege 2368 563465.exe Token: SeSystemtimePrivilege 2368 563465.exe Token: SeProfSingleProcessPrivilege 2368 563465.exe Token: SeIncBasePriorityPrivilege 2368 563465.exe Token: SeCreatePagefilePrivilege 2368 563465.exe Token: SeBackupPrivilege 2368 563465.exe Token: SeRestorePrivilege 2368 563465.exe Token: SeShutdownPrivilege 2368 563465.exe Token: SeDebugPrivilege 2368 563465.exe Token: SeSystemEnvironmentPrivilege 2368 563465.exe Token: SeChangeNotifyPrivilege 2368 563465.exe Token: SeRemoteShutdownPrivilege 2368 563465.exe Token: SeUndockPrivilege 2368 563465.exe Token: SeManageVolumePrivilege 2368 563465.exe Token: SeImpersonatePrivilege 2368 563465.exe Token: SeCreateGlobalPrivilege 2368 563465.exe Token: 33 2368 563465.exe Token: 34 2368 563465.exe Token: 35 2368 563465.exe Token: SeDebugPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe Token: 33 2148 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 2148 Extreme Injector v2 by master131.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Extreme Injector v2 by master131.exedescription pid Process procid_target PID 2404 wrote to memory of 2148 2404 Extreme Injector v2 by master131.exe 30 PID 2404 wrote to memory of 2148 2404 Extreme Injector v2 by master131.exe 30 PID 2404 wrote to memory of 2148 2404 Extreme Injector v2 by master131.exe 30 PID 2404 wrote to memory of 2148 2404 Extreme Injector v2 by master131.exe 30 PID 2404 wrote to memory of 2368 2404 Extreme Injector v2 by master131.exe 31 PID 2404 wrote to memory of 2368 2404 Extreme Injector v2 by master131.exe 31 PID 2404 wrote to memory of 2368 2404 Extreme Injector v2 by master131.exe 31 PID 2404 wrote to memory of 2368 2404 Extreme Injector v2 by master131.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\133Devblock cheat\Extreme Injector v2 by master131.exe"C:\Users\Admin\AppData\Local\Temp\133Devblock cheat\Extreme Injector v2 by master131.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v2 by master131.exe"C:\Users\Admin\AppData\Local\Temp\Extreme Injector v2 by master131.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
C:\Users\Admin\AppData\Local\Temp\563465.exe"C:\Users\Admin\AppData\Local\Temp\563465.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
657KB
MD52021da3e215282fee59ac87c08494326
SHA18c182e58983d339ad16b780f4b4f3f71790d35cd
SHA2565f68118f9513f60ea938b623634ba9e944d04bd3ba9971f0c35a4ea8e982b560
SHA5120db510123d44e1dd662028610cb67f14d43a521a27cf885833be2bb928683be5061e52a41dc27449031ce6e4222e0b11eee9378ab26518eb1104ab9efbbcfcb1
-
Filesize
183KB
MD5f73cd66590e62e52a015bffe9de6b976
SHA169dda66f6d24b102f3b779ff2a6d202fb1d1e79f
SHA25692d70bc223425270dcd62950e97571ba0c47e3488db306648bf927d8931cb04a
SHA512e4115c6a26f68389691556dff95f1ac33e9949b8fb0d5fc5574de4058b4e79e5c3d21f93059b7c47b1f8193e85a82998bbe8fd575a119c1f43dec10bddd26f4d