Overview

overview

10

Static

static

7

malware/1/Setup.exe

windows7-x64

10

malware/1/Setup.exe

windows10-2004-x64

10

malware/2/Setup.exe

windows7-x64

10

malware/2/Setup.exe

windows10-2004-x64

10

malware/3/...p_.exe

windows7-x64

7

malware/3/...p_.exe

windows10-2004-x64

7

malware/4/Setup.exe

windows7-x64

10

malware/4/Setup.exe

windows10-2004-x64

10

malware/5/...ls.dll

windows7-x64

1

malware/5/...ls.dll

windows10-2004-x64

1

malware/5/...ng.dll

windows7-x64

1

malware/5/...ng.dll

windows10-2004-x64

1

malware/5/...nt.dll

windows7-x64

1

malware/5/...nt.dll

windows10-2004-x64

1

malware/5/...pt.dll

windows7-x64

1

malware/5/...pt.dll

windows10-2004-x64

1

malware/5/...ib.dll

windows7-x64

1

malware/5/...ib.dll

windows10-2004-x64

1

malware/5/...ns.dll

windows7-x64

1

malware/5/...ns.dll

windows10-2004-x64

1

malware/5/...on.dll

windows7-x64

1

malware/5/...on.dll

windows10-2004-x64

1

malware/5/...op.dll

windows7-x64

3

malware/5/...op.dll

windows10-2004-x64

3

malware/5/...en.dll

windows7-x64

1

malware/5/...en.dll

windows10-2004-x64

1

malware/5/...te.dll

windows7-x64

1

malware/5/...te.dll

windows10-2004-x64

1

malware/5/...ty.dll

windows7-x64

1

malware/5/...ty.dll

windows10-2004-x64

1

malware/5/...api.js

windows7-x64

3

malware/5/...api.js

windows10-2004-x64

3

Analysis

  • max time kernel
    89s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2024, 13:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    malware/3/free_sea_of_thieves_hacks_(esp_.exe

  • Size

    2.2MB

  • MD5

    bbcbdf10e868888b4e282d7c5ae8284c

  • SHA1

    6bcf6542cda09ea714fa9e5c3534f944c5850be7

  • SHA256

    62884dd5b5d6a129bc9c7f58d9fd302840aeb3e57606739c5d00ccea4dadc4e5

  • SHA512

    9b2c88302551202dd23513105b26d7d96c32759a250fe98533ba6c596fb862881b497616c86900cf81ae4fb5ebbff17ea51a65130deeca259ba9082b33862891

  • SSDEEP

    49152:XBuZrEUtZgrzYCbf7iJI7c3955DdN7POGjb:xkLtZS8CbDiAc3955ljb

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 7 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\malware\3\free_sea_of_thieves_hacks_(esp_.exe
    "C:\Users\Admin\AppData\Local\Temp\malware\3\free_sea_of_thieves_hacks_(esp_.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\is-ASH7S.tmp\free_sea_of_thieves_hacks_(esp_.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ASH7S.tmp\free_sea_of_thieves_hacks_(esp_.tmp" /SL5="$60180,1468326,832512,C:\Users\Admin\AppData\Local\Temp\malware\3\free_sea_of_thieves_hacks_(esp_.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4940
      • C:\Users\Admin\AppData\Local\Temp\malware\3\free_sea_of_thieves_hacks_(esp_.exe
        "C:\Users\Admin\AppData\Local\Temp\malware\3\free_sea_of_thieves_hacks_(esp_.exe" /VERYSILENT
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Users\Admin\AppData\Local\Temp\is-7A7M2.tmp\free_sea_of_thieves_hacks_(esp_.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-7A7M2.tmp\free_sea_of_thieves_hacks_(esp_.tmp" /SL5="$601D0,1468326,832512,C:\Users\Admin\AppData\Local\Temp\malware\3\free_sea_of_thieves_hacks_(esp_.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3520
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 496
              6⤵
              • Program crash
              PID:844
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3520 -ip 3520
    1⤵
      PID:2420

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\is-ASH7S.tmp\free_sea_of_thieves_hacks_(esp_.tmp
      Filesize

      3.0MB

      MD5

      3eaff7e1673fb0c861fb64673fec879a

      SHA1

      a2a807afe6ea5d9b2514905c4a80a95902ccf49a

      SHA256

      f0c623454f125108efc782e97a8e27f79a44f53b91a6bb748941dbf3dd1a8844

      SHA512

      eaef70c564a5c2b9eb04cf87de9fa3d91e4a88afb94b659d2a5ba3814d8122d139a3c738d9b159a3e02848512ecbc206eed6282ae43299717d5f1475e2f96c7b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\is-CC0BR.tmp\gug.dll
      Filesize

      299KB

      MD5

      c85f725bedbb8c0d5f969b3d0214b343

      SHA1

      efa71da1cbb6ba1e41f501206f2fe334a45d51cc

      SHA256

      12711f46d3e494e7db4196ee6a3f2940c38d318798a4a86c2abbb23b7695ab35

      SHA512

      acc798eb2dfbc3cc84f02624a69cdbb60a7929352f39a1718ad57323b808e5e7558d984833fb0b4f4524109f73356d7d5b5b5c01c1b013b06af53c01e821c8f1

      Download Submit

    • memory/2752-52-0x0000000000400000-0x000000000071B000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/2752-24-0x0000000000400000-0x000000000071B000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/3520-29-0x0000000000670000-0x000000000069F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/3520-55-0x0000000000670000-0x000000000069F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/3520-30-0x0000000000670000-0x000000000069F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/3768-2-0x0000000000401000-0x00000000004B7000-memory.dmp

      Filesize

      728KB

      Download

    • memory/3768-0-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

      Download

    • memory/3768-19-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

      Download

    • memory/4616-15-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

      Download

    • memory/4616-13-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

      Download

    • memory/4616-54-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

      Download

    • memory/4940-17-0x0000000000400000-0x000000000071B000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/4940-6-0x0000000000400000-0x000000000071B000-memory.dmp

      Filesize

      3.1MB

      Download