222a95474744c4152632a32f39113b2e4463b687176165a156ea37b0128ae4ea

Analysis

max time kernel
35s
max time network
17s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vortex/lib/aimbot.py
Size

10KB
MD5

e616a5ffe2d41c26348cadf31a129730
SHA1

7a6aa6450d51c6a99a716e6e487a4752c3a48b8b
SHA256

3e7ccdd6041473b71e4d5327a6e35c56de00ff82837fd67ea93fc4604e69d4b8
SHA512

7dcb365f347f65c8a71398c123ddfff8cf3d52fd09fe1ee489dff037fe90c951071f0eeed29ab56ed7824efeca3e26897318f2d18f58f614589b24a8e5047d03
SSDEEP

192:KfUxd4DcPCDxSd4DcbDkCF8wJAsbBM+jkfinv5ItH+N4xuwHx/MyM0inP5Pk21Ix:KsxIiCYMMYfMnPpd1Dm8Or9Pn

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2368	AcroRd32.exe
2368	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1672	3044	cmd.exe	31
PID 3044 wrote to memory of 1672	3044	cmd.exe	31
PID 3044 wrote to memory of 1672	3044	cmd.exe	31
PID 1672 wrote to memory of 2368	1672	rundll32.exe	32
PID 1672 wrote to memory of 2368	1672	rundll32.exe	32
PID 1672 wrote to memory of 2368	1672	rundll32.exe	32
PID 1672 wrote to memory of 2368	1672	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Vortex\lib\aimbot.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Vortex\lib\aimbot.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Vortex\lib\aimbot.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ae6d08a819db8eba7ec1c26db334cfc9

SHA1
5a7154fffce6b3041ea100bcd49faca17c490a4e

SHA256
71203077691a092b4ba92661dd8ea0e308326c9bc04bed935da2a8ad972aab54

SHA512
e4db486091faab6ba5e3cd44f15178a61a837d27370374c24bf74bd38115e2449d7338630ae412eb79811bfba9c227b6f9f0169556ac928e4803f66554e82b1f

Download Submit