Overview
overview
10Static
static
10133Devbloc...31.exe
windows7-x64
10133Devbloc...31.exe
windows10-2004-x64
10133Devbloc...ME.dll
windows7-x64
1133Devbloc...ME.dll
windows10-2004-x64
1133Devbloc...v2.dll
windows7-x64
1133Devbloc...v2.dll
windows10-2004-x64
1133Devbloc...3s.dll
windows7-x64
3133Devbloc...3s.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 16:17
Behavioral task
behavioral1
Sample
133Devblock cheat/Extreme Injector v2 by master131.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
133Devblock cheat/Extreme Injector v2 by master131.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
133Devblock cheat/UInjectIME.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
133Devblock cheat/UInjectIME.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
133Devblock cheat/UnityLoaderv2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
133Devblock cheat/UnityLoaderv2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
133Devblock cheat/hax3s.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
133Devblock cheat/hax3s.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
133Devblock cheat/Extreme Injector v2 by master131.exe
-
Size
865KB
-
MD5
4e49565cbd3e2a63b3ade2b8532ec912
-
SHA1
0092c941f2432f597a663b1fa627764c732de1e6
-
SHA256
8d595ae8374459d800de2f9ccbf5eba2136e005168489cf7d07fc97eefd54077
-
SHA512
973d4ccc99be60d48d05dbe5b54307480d846a9db86a65e766a0640e5db54a1eabe55b3ee6767f9c63bfc63c5c0463dd89e00d5431a28d294f28da52ee7d1d39
-
SSDEEP
12288:YTKa4lZWCw0K9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFX:YyZtGiBIGkbxqEcjsWiDxguehC2SA
Malware Config
Signatures
-
Darkcomet family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Extreme Injector v2 by master131.exe -
Executes dropped EXE 2 IoCs
pid Process 5012 Extreme Injector v2 by master131.exe 692 563465.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini Extreme Injector v2 by master131.exe File opened for modification C:\Windows\assembly\Desktop.ini Extreme Injector v2 by master131.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly Extreme Injector v2 by master131.exe File created C:\Windows\assembly\Desktop.ini Extreme Injector v2 by master131.exe File opened for modification C:\Windows\assembly\Desktop.ini Extreme Injector v2 by master131.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extreme Injector v2 by master131.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 563465.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe 5012 Extreme Injector v2 by master131.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 692 563465.exe Token: SeSecurityPrivilege 692 563465.exe Token: SeTakeOwnershipPrivilege 692 563465.exe Token: SeLoadDriverPrivilege 692 563465.exe Token: SeSystemProfilePrivilege 692 563465.exe Token: SeSystemtimePrivilege 692 563465.exe Token: SeProfSingleProcessPrivilege 692 563465.exe Token: SeIncBasePriorityPrivilege 692 563465.exe Token: SeCreatePagefilePrivilege 692 563465.exe Token: SeBackupPrivilege 692 563465.exe Token: SeRestorePrivilege 692 563465.exe Token: SeShutdownPrivilege 692 563465.exe Token: SeDebugPrivilege 692 563465.exe Token: SeSystemEnvironmentPrivilege 692 563465.exe Token: SeChangeNotifyPrivilege 692 563465.exe Token: SeRemoteShutdownPrivilege 692 563465.exe Token: SeUndockPrivilege 692 563465.exe Token: SeManageVolumePrivilege 692 563465.exe Token: SeImpersonatePrivilege 692 563465.exe Token: SeCreateGlobalPrivilege 692 563465.exe Token: 33 692 563465.exe Token: 34 692 563465.exe Token: 35 692 563465.exe Token: 36 692 563465.exe Token: SeDebugPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe Token: SeIncBasePriorityPrivilege 5012 Extreme Injector v2 by master131.exe Token: 33 5012 Extreme Injector v2 by master131.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1308 wrote to memory of 5012 1308 Extreme Injector v2 by master131.exe 83 PID 1308 wrote to memory of 5012 1308 Extreme Injector v2 by master131.exe 83 PID 1308 wrote to memory of 692 1308 Extreme Injector v2 by master131.exe 84 PID 1308 wrote to memory of 692 1308 Extreme Injector v2 by master131.exe 84 PID 1308 wrote to memory of 692 1308 Extreme Injector v2 by master131.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\133Devblock cheat\Extreme Injector v2 by master131.exe"C:\Users\Admin\AppData\Local\Temp\133Devblock cheat\Extreme Injector v2 by master131.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v2 by master131.exe"C:\Users\Admin\AppData\Local\Temp\Extreme Injector v2 by master131.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Users\Admin\AppData\Local\Temp\563465.exe"C:\Users\Admin\AppData\Local\Temp\563465.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
657KB
MD52021da3e215282fee59ac87c08494326
SHA18c182e58983d339ad16b780f4b4f3f71790d35cd
SHA2565f68118f9513f60ea938b623634ba9e944d04bd3ba9971f0c35a4ea8e982b560
SHA5120db510123d44e1dd662028610cb67f14d43a521a27cf885833be2bb928683be5061e52a41dc27449031ce6e4222e0b11eee9378ab26518eb1104ab9efbbcfcb1
-
Filesize
183KB
MD5f73cd66590e62e52a015bffe9de6b976
SHA169dda66f6d24b102f3b779ff2a6d202fb1d1e79f
SHA25692d70bc223425270dcd62950e97571ba0c47e3488db306648bf927d8931cb04a
SHA512e4115c6a26f68389691556dff95f1ac33e9949b8fb0d5fc5574de4058b4e79e5c3d21f93059b7c47b1f8193e85a82998bbe8fd575a119c1f43dec10bddd26f4d