734f289e454119f1bb31e9f4963c64e5230b51264229a1832b1707b9753f276c

Analysis

max time kernel
63s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2025 14:59

Target

bluewing TS/valorant full.exe
Size

910KB
MD5

a4589be07699d55f1e84de98fb8e14dc
SHA1

409e3df648fcd2bd70d5569ba9e39faa4b6eefb3
SHA256

54abc7b31f3167221eb186cf5a1ab9dc7b4945e9da4a241b46b7fbeb932fe3c7
SHA512

313d34b55a8ffe68c208b800f77610b1cd2740f1b56939d1b95b8793b7c643da767237649c5534ea9eb39bd60e2776c2542fb38326bd817d728d8984b8fdcda6
SSDEEP

24576:lKg+vBX4JpuCUX0Qpuvgdx/y5RL90q+wRw:z+Zupu/kqFdxENAwRw

Score

5^/10

upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3668	valorant full.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral14/memory/3668-0-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp	upx
behavioral14/memory/3668-8-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp	upx
behavioral14/memory/3668-9-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp	upx
behavioral14/memory/3668-15-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp	upx
behavioral14/memory/3668-20-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp	upx
behavioral14/memory/3668-25-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp	upx
behavioral14/memory/3668-31-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp	upx
behavioral14/memory/3668-37-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 52 IoCs

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 368	3668	valorant full.exe	86
PID 3668 wrote to memory of 368	3668	valorant full.exe	86
PID 368 wrote to memory of 2204	368	cmd.exe	87
PID 368 wrote to memory of 2204	368	cmd.exe	87
PID 368 wrote to memory of 1952	368	cmd.exe	88
PID 368 wrote to memory of 1952	368	cmd.exe	88
PID 368 wrote to memory of 3060	368	cmd.exe	89
PID 368 wrote to memory of 3060	368	cmd.exe	89
PID 3668 wrote to memory of 4140	3668	valorant full.exe	90
PID 3668 wrote to memory of 4140	3668	valorant full.exe	90
PID 3668 wrote to memory of 464	3668	valorant full.exe	91
PID 3668 wrote to memory of 464	3668	valorant full.exe	91
PID 464 wrote to memory of 4936	464	cmd.exe	92
PID 464 wrote to memory of 4936	464	cmd.exe	92
PID 3668 wrote to memory of 3852	3668	valorant full.exe	97
PID 3668 wrote to memory of 3852	3668	valorant full.exe	97

C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe
"C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe" MD5
    3⤵
    PID:2204
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1952
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s -o C:\VG-Config\control.txt http://www.eccheats.store/control.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\curl.exe
    curl -s -o C:\VG-Config\control.txt http://www.eccheats.store/control.txt
    3⤵
    PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3852

C:\ProgramData\KeyAuth\Debug\valorant full\02-21-2025.txt

Filesize
6KB

MD5
676dfda2df4986cf701e8fc6b420fb85

SHA1
988193cf78f0783c6c4339702350169daa2dcfd1

SHA256
ca1b3d66712a962699d431bf1492b3b8496ff476e43323984e25c312c64fc1c6

SHA512
fa25e1f66067336fb6ec9d74ac059f3b0b0794c2dbb54a730fd24d23ceef69c7171d6be4588fb707dc6f56ae196f73b6e4cbf28c637790b26ae1d930d8a6bbd2

Download Submit
C:\VG-Config\control.txt

Filesize
3B

MD5
c5301693c4e792bcd5a479ef38fb8f8d

SHA1
b1b392607deaf29a7e81453e069b7c07a32a6b18

SHA256
00d60e31a4e6b8344d4201f25a6a7dee770713107f6d097abb01559d32b17f26

SHA512
2a25cdbf38d8390e5f91a0da0c4352e53c4d2ff002c83410ddbfcaf71919f6dee74bd37f597c30225c8fa9e88854605faac5c8d6efbda0e50b2715b7d31d94b5

Download Submit
memory/3668-0-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp

Filesize
1.9MB

Download
memory/3668-8-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp

Filesize
1.9MB

Download
memory/3668-9-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp

Filesize
1.9MB

Download
memory/3668-15-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp

Filesize
1.9MB

Download
memory/3668-20-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp

Filesize
1.9MB

Download
memory/3668-25-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp

Filesize
1.9MB

Download
memory/3668-31-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp

Filesize
1.9MB

Download
memory/3668-37-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp

Filesize
1.9MB

Download