09eeb778d2b787fb4a329923ce022d54c8b980213698d74487913700e40b5f1e

Resubmissions

14/01/2025, 06:33

250114-hbk26s1rem 10

14/01/2025, 06:12

250114-gyapaa1mfq 10

19/06/2022, 16:53

220619-vdyr9sfcgl 10

Analysis

max time kernel
118s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/01/2025, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AmongusHack.exe
Size

202KB
MD5

5c39bb532bd116ae2c9e47528c9f81f3
SHA1

4af704758e4d281997df43811fcd759e4b3ea755
SHA256

09eeb778d2b787fb4a329923ce022d54c8b980213698d74487913700e40b5f1e
SHA512

18cd104f1d9ec1c6b52f0461d9cbba4483bad21074805e0e8c425045d77e439e795b19953964abc791f7b17dc7247d4481c2e4e6083019e8e5b4ca704682d320
SSDEEP

3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI0aqPoOeRontyZEgszB8DYLJqE:gLV6Bta6dtJmakIM5pP1jMZIt8DffeLr

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmongusHack.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2856	2116	AmongusHack.exe	30
PID 2116 wrote to memory of 2856	2116	AmongusHack.exe	30
PID 2116 wrote to memory of 2856	2116	AmongusHack.exe	30
PID 2116 wrote to memory of 2856	2116	AmongusHack.exe	30
PID 2856 wrote to memory of 2164	2856	AmongusHack.exe	31
PID 2856 wrote to memory of 2164	2856	AmongusHack.exe	31
PID 2856 wrote to memory of 2164	2856	AmongusHack.exe	31
PID 2856 wrote to memory of 2164	2856	AmongusHack.exe	31
PID 2164 wrote to memory of 2796	2164	AmongusHack.exe	32
PID 2164 wrote to memory of 2796	2164	AmongusHack.exe	32
PID 2164 wrote to memory of 2796	2164	AmongusHack.exe	32
PID 2164 wrote to memory of 2796	2164	AmongusHack.exe	32
PID 2796 wrote to memory of 2840	2796	AmongusHack.exe	34
PID 2796 wrote to memory of 2840	2796	AmongusHack.exe	34
PID 2796 wrote to memory of 2840	2796	AmongusHack.exe	34
PID 2796 wrote to memory of 2840	2796	AmongusHack.exe	34
PID 2840 wrote to memory of 2632	2840	AmongusHack.exe	35
PID 2840 wrote to memory of 2632	2840	AmongusHack.exe	35
PID 2840 wrote to memory of 2632	2840	AmongusHack.exe	35
PID 2840 wrote to memory of 2632	2840	AmongusHack.exe	35
PID 2632 wrote to memory of 3052	2632	AmongusHack.exe	36
PID 2632 wrote to memory of 3052	2632	AmongusHack.exe	36
PID 2632 wrote to memory of 3052	2632	AmongusHack.exe	36
PID 2632 wrote to memory of 3052	2632	AmongusHack.exe	36
PID 3052 wrote to memory of 732	3052	AmongusHack.exe	37
PID 3052 wrote to memory of 732	3052	AmongusHack.exe	37
PID 3052 wrote to memory of 732	3052	AmongusHack.exe	37
PID 3052 wrote to memory of 732	3052	AmongusHack.exe	37
PID 732 wrote to memory of 1764	732	AmongusHack.exe	38
PID 732 wrote to memory of 1764	732	AmongusHack.exe	38
PID 732 wrote to memory of 1764	732	AmongusHack.exe	38
PID 732 wrote to memory of 1764	732	AmongusHack.exe	38
PID 1764 wrote to memory of 2000	1764	AmongusHack.exe	39
PID 1764 wrote to memory of 2000	1764	AmongusHack.exe	39
PID 1764 wrote to memory of 2000	1764	AmongusHack.exe	39
PID 1764 wrote to memory of 2000	1764	AmongusHack.exe	39
PID 2000 wrote to memory of 1252	2000	AmongusHack.exe	40
PID 2000 wrote to memory of 1252	2000	AmongusHack.exe	40
PID 2000 wrote to memory of 1252	2000	AmongusHack.exe	40
PID 2000 wrote to memory of 1252	2000	AmongusHack.exe	40
PID 1252 wrote to memory of 2888	1252	AmongusHack.exe	41
PID 1252 wrote to memory of 2888	1252	AmongusHack.exe	41
PID 1252 wrote to memory of 2888	1252	AmongusHack.exe	41
PID 1252 wrote to memory of 2888	1252	AmongusHack.exe	41
PID 2888 wrote to memory of 288	2888	AmongusHack.exe	42
PID 2888 wrote to memory of 288	2888	AmongusHack.exe	42
PID 2888 wrote to memory of 288	2888	AmongusHack.exe	42
PID 2888 wrote to memory of 288	2888	AmongusHack.exe	42
PID 288 wrote to memory of 712	288	AmongusHack.exe	43
PID 288 wrote to memory of 712	288	AmongusHack.exe	43
PID 288 wrote to memory of 712	288	AmongusHack.exe	43
PID 288 wrote to memory of 712	288	AmongusHack.exe	43
PID 712 wrote to memory of 2236	712	AmongusHack.exe	44
PID 712 wrote to memory of 2236	712	AmongusHack.exe	44
PID 712 wrote to memory of 2236	712	AmongusHack.exe	44
PID 712 wrote to memory of 2236	712	AmongusHack.exe	44
PID 2236 wrote to memory of 276	2236	AmongusHack.exe	45
PID 2236 wrote to memory of 276	2236	AmongusHack.exe	45
PID 2236 wrote to memory of 276	2236	AmongusHack.exe	45
PID 2236 wrote to memory of 276	2236	AmongusHack.exe	45
PID 276 wrote to memory of 1532	276	AmongusHack.exe	46
PID 276 wrote to memory of 1532	276	AmongusHack.exe	46
PID 276 wrote to memory of 1532	276	AmongusHack.exe	46
PID 276 wrote to memory of 1532	276	AmongusHack.exe	46

C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
  "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
    "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
      "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        13⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        14⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        15⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        16⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x0000000074801000-0x0000000074802000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2116-2-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2116-3-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2856-4-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2856-5-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2856-6-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download