Resubmissions

14-01-2025 06:33

250114-hbk26s1rem 10

14-01-2025 06:12

250114-gyapaa1mfq 10

19-06-2022 16:53

220619-vdyr9sfcgl 10

Analysis

  • max time kernel
    115s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-01-2025 06:33

General

  • Target

    AmongusHack.exe

  • Size

    202KB

  • MD5

    5c39bb532bd116ae2c9e47528c9f81f3

  • SHA1

    4af704758e4d281997df43811fcd759e4b3ea755

  • SHA256

    09eeb778d2b787fb4a329923ce022d54c8b980213698d74487913700e40b5f1e

  • SHA512

    18cd104f1d9ec1c6b52f0461d9cbba4483bad21074805e0e8c425045d77e439e795b19953964abc791f7b17dc7247d4481c2e4e6083019e8e5b4ca704682d320

  • SSDEEP

    3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI0aqPoOeRontyZEgszB8DYLJqE:gLV6Bta6dtJmakIM5pP1jMZIt8DffeLr

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 21 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
    C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
      "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:220
        • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
          "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:888
          • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
            "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:916
            • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
              "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
              6⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4544
              • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4444
                • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                  "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                  8⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3832
                  • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                    "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                    9⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2900
                    • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                      "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                      10⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1632
                      • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                        11⤵
                        • Checks computer location settings
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3896
                        • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                          "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                          12⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4176
                          • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                            "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                            13⤵
                            • Checks computer location settings
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:184
                            • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                              "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                              14⤵
                              • Checks computer location settings
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4392
                              • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                                "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                                15⤵
                                • Checks computer location settings
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:984
                                • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                                  "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4564
                                  • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                                    "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4452
                                    • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                                      "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                                      18⤵
                                      • Checks computer location settings
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:4676
                                      • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                                        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:5044
                                        • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                                          "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:2780
                                          • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                                            "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                                            21⤵
                                            • Checks computer location settings
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1576
                                            • C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
                                              "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1032

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    180.129.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    180.129.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    167.173.78.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    167.173.78.104.in-addr.arpa
    IN PTR
    Response
    167.173.78.104.in-addr.arpa
    IN PTR
    a104-78-173-167deploystaticakamaitechnologiescom
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    92.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    92.12.20.2.in-addr.arpa
    IN PTR
    Response
    92.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-92deploystaticakamaitechnologiescom
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
No results found
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    180.129.81.91.in-addr.arpa
    dns
    72 B
    147 B
    1
    1

    DNS Request

    180.129.81.91.in-addr.arpa

  • 8.8.8.8:53
    14.160.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    167.173.78.104.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    167.173.78.104.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    92.12.20.2.in-addr.arpa
    dns
    69 B
    131 B
    1
    1

    DNS Request

    92.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    144 B
    158 B
    2
    1

    DNS Request

    19.229.111.52.in-addr.arpa

    DNS Request

    19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\AmongusHack.exe.log

    Filesize

    496B

    MD5

    5b4789d01bb4d7483b71e1a35bce6a8b

    SHA1

    de083f2131c9a763c0d1810c97a38732146cffbf

    SHA256

    e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6

    SHA512

    357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede

  • memory/220-9-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

  • memory/220-11-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

  • memory/220-10-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

  • memory/220-12-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

  • memory/2124-0-0x0000000074622000-0x0000000074623000-memory.dmp

    Filesize

    4KB

  • memory/2124-1-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

  • memory/2124-2-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

  • memory/2124-6-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-5-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-7-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-8-0x0000000074620000-0x0000000074BD1000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.