Analysis
- max time kernel
120s - max time network
129s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
21/02/2025, 14:59
General
- Target bluewing TS/valorant esp.exe
- Size 7.5MB
- Sample250221-sc4wsawks7
- SHA256 a92207cdaeabf1e5837d5c78c581c2af75052f6b6c162d666cd66931879d9f8e
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant esp.exe"C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant esp.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant esp.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant esp.exe" MD53⤵
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3012-0-0x00000001400F3000-0x0000000140617000-memory.dmp
memory/3012-20-0x0000000077DD0000-0x0000000077DD2000-memory.dmp
memory/3012-18-0x0000000077DD0000-0x0000000077DD2000-memory.dmp
memory/3012-16-0x0000000077DD0000-0x0000000077DD2000-memory.dmp
memory/3012-15-0x0000000077DC0000-0x0000000077DC2000-memory.dmp
memory/3012-13-0x0000000077DC0000-0x0000000077DC2000-memory.dmp
memory/3012-11-0x0000000077DC0000-0x0000000077DC2000-memory.dmp
memory/3012-10-0x0000000077DA0000-0x0000000077DA2000-memory.dmp
memory/3012-8-0x0000000077DA0000-0x0000000077DA2000-memory.dmp
memory/3012-6-0x0000000077DA0000-0x0000000077DA2000-memory.dmp
memory/3012-5-0x0000000077D90000-0x0000000077D92000-memory.dmp
memory/3012-3-0x0000000077D90000-0x0000000077D92000-memory.dmp
memory/3012-36-0x000007FEFDAB0000-0x000007FEFDAB2000-memory.dmp
memory/3012-34-0x000007FEFDAB0000-0x000007FEFDAB2000-memory.dmp
memory/3012-31-0x0000000077DF0000-0x0000000077DF2000-memory.dmp
memory/3012-29-0x0000000077DF0000-0x0000000077DF2000-memory.dmp
memory/3012-27-0x0000000077DF0000-0x0000000077DF2000-memory.dmp
memory/3012-26-0x0000000140000000-0x0000000140D9F000-memory.dmp
memory/3012-41-0x000007FEFDAC0000-0x000007FEFDAC2000-memory.dmp
memory/3012-39-0x000007FEFDAC0000-0x000007FEFDAC2000-memory.dmp
memory/3012-25-0x0000000077DE0000-0x0000000077DE2000-memory.dmp
memory/3012-23-0x0000000077DE0000-0x0000000077DE2000-memory.dmp
memory/3012-21-0x0000000077DE0000-0x0000000077DE2000-memory.dmp
memory/3012-1-0x0000000077D90000-0x0000000077D92000-memory.dmp
memory/3012-46-0x0000000140000000-0x0000000140D9F000-memory.dmp
memory/3012-47-0x0000000140000000-0x0000000140D9F000-memory.dmp
memory/3012-49-0x00000001400F3000-0x0000000140617000-memory.dmp
memory/3012-50-0x0000000140000000-0x0000000140D9F000-memory.dmp