Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-12-2024 02:36
General
-
Target
FARCRY3_+16._AOBeta._SteamDX9.exe
-
Size
1.8MB
-
MD5
a32ace277e7f42ce0eff7dfa2436bdae
-
SHA1
b76cf92eb53cad790fb1c99778e7f005e8b9a465
-
SHA256
2531e9f941ecf91e7e6f8f0b6a146d05d77d0c14aa90c1ac8b8000261ac66c49
-
SHA512
2a405f6c64c45d741edac1c8ee87906c605e520733f76d33b84f73b75968d56aa7986437aa304b6d571f490113be757b4c016e96485c95406988d664ea38fcb4
-
SSDEEP
49152:opTO1FhLU+laOiVoqjGZ8oLLghkWzPT7a6mEe+wt:opIFlaOmpoEiUPa6Xe+s
Score
10/10
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FARCRY3_+16._AOBeta._SteamDX9.exe"C:\Users\Admin\AppData\Local\Temp\FARCRY3_+16._AOBeta._SteamDX9.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x538 0x3081⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB