e095c09c0839a85ecd84346a853c9c7333c51d1d0080ea41b5cee1f6f897c243

Analysis

max time kernel
19s
max time network
21s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29/12/2024, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malware/3/free_sea_of_thieves_hacks_(esp_.exe
Size

2.2MB
MD5

bbcbdf10e868888b4e282d7c5ae8284c
SHA1

6bcf6542cda09ea714fa9e5c3534f944c5850be7
SHA256

62884dd5b5d6a129bc9c7f58d9fd302840aeb3e57606739c5d00ccea4dadc4e5
SHA512

9b2c88302551202dd23513105b26d7d96c32759a250fe98533ba6c596fb862881b497616c86900cf81ae4fb5ebbff17ea51a65130deeca259ba9082b33862891
SSDEEP

49152:XBuZrEUtZgrzYCbf7iJI7c3955DdN7POGjb:xkLtZS8CbDiAc3955ljb

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2868	free_sea_of_thieves_hacks_(esp_.tmp

Loads dropped DLL 2 IoCs

pid	Process
2512	free_sea_of_thieves_hacks_(esp_.exe
2868	free_sea_of_thieves_hacks_(esp_.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	free_sea_of_thieves_hacks_(esp_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	free_sea_of_thieves_hacks_(esp_.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2868	2512	free_sea_of_thieves_hacks_(esp_.exe	29
PID 2512 wrote to memory of 2868	2512	free_sea_of_thieves_hacks_(esp_.exe	29
PID 2512 wrote to memory of 2868	2512	free_sea_of_thieves_hacks_(esp_.exe	29
PID 2512 wrote to memory of 2868	2512	free_sea_of_thieves_hacks_(esp_.exe	29
PID 2512 wrote to memory of 2868	2512	free_sea_of_thieves_hacks_(esp_.exe	29
PID 2512 wrote to memory of 2868	2512	free_sea_of_thieves_hacks_(esp_.exe	29
PID 2512 wrote to memory of 2868	2512	free_sea_of_thieves_hacks_(esp_.exe	29

C:\Users\Admin\AppData\Local\Temp\malware\3\free_sea_of_thieves_hacks_(esp_.exe
"C:\Users\Admin\AppData\Local\Temp\malware\3\free_sea_of_thieves_hacks_(esp_.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\is-FKLIA.tmp\free_sea_of_thieves_hacks_(esp_.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FKLIA.tmp\free_sea_of_thieves_hacks_(esp_.tmp" /SL5="$6001E,1468326,832512,C:\Users\Admin\AppData\Local\Temp\malware\3\free_sea_of_thieves_hacks_(esp_.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-FKLIA.tmp\free_sea_of_thieves_hacks_(esp_.tmp

Filesize
3.0MB

MD5
3eaff7e1673fb0c861fb64673fec879a

SHA1
a2a807afe6ea5d9b2514905c4a80a95902ccf49a

SHA256
f0c623454f125108efc782e97a8e27f79a44f53b91a6bb748941dbf3dd1a8844

SHA512
eaef70c564a5c2b9eb04cf87de9fa3d91e4a88afb94b659d2a5ba3814d8122d139a3c738d9b159a3e02848512ecbc206eed6282ae43299717d5f1475e2f96c7b

Download Submit
\Users\Admin\AppData\Local\Temp\is-H4HUR.tmp\gug.dll

Filesize
299KB

MD5
c85f725bedbb8c0d5f969b3d0214b343

SHA1
efa71da1cbb6ba1e41f501206f2fe334a45d51cc

SHA256
12711f46d3e494e7db4196ee6a3f2940c38d318798a4a86c2abbb23b7695ab35

SHA512
acc798eb2dfbc3cc84f02624a69cdbb60a7929352f39a1718ad57323b808e5e7558d984833fb0b4f4524109f73356d7d5b5b5c01c1b013b06af53c01e821c8f1

Download Submit
memory/2512-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2512-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2512-17-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2868-8-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2868-15-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download