Analysis
-
max time kernel
142s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
09/04/2025, 08:20
General
-
Target
1a6ed538d9ee30c5d1988968896c7028f99b24f43e5abbae96cc63281bcd8bed.exe
-
Size
1.7MB
-
MD5
0cc5dc97283bfeee413467481e6822b4
-
SHA1
e60240c37dc62b6ae1795583cab43dc10bb9dce0
-
SHA256
1a6ed538d9ee30c5d1988968896c7028f99b24f43e5abbae96cc63281bcd8bed
-
SHA512
e2794ef5d4abb23ba09ad1e9884c0463dff0ac43608f1b30053949727fafdca957ad2980bb43f655940eaf215f0ac52e37f90369aa621033b4c775875cc008b0
-
SSDEEP
24576:9lXvnqqFQJLYYC2TU6oH+gyFlbUscwL4ie+JwcIKIgYbK1uV9279NAl5Q9AxJ//F:zfKq0lbUscwkp+jmcVg3Uha
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a6ed538d9ee30c5d1988968896c7028f99b24f43e5abbae96cc63281bcd8bed.exe"C:\Users\Admin\AppData\Local\Temp\1a6ed538d9ee30c5d1988968896c7028f99b24f43e5abbae96cc63281bcd8bed.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Enshrouded-Multiplayer-Fix-Online-v1.2.exe"C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Enshrouded-Multiplayer-Fix-Online-v1.2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ABLNT.tmp\[FreeTP.Org]Enshrouded-Multiplayer-Fix-Online-v1.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-ABLNT.tmp\[FreeTP.Org]Enshrouded-Multiplayer-Fix-Online-v1.2.tmp" /SL5="$5004E,722115,152064,C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Enshrouded-Multiplayer-Fix-Online-v1.2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c2a1bd6ace6cdb4b8de1b120e2b39e4f
SHA1a75cfe74a7ff7574b1e3b494d9e56bd527eb0074
SHA256e8ca4938e08021e1db3ac1bbf498ceca3c21264584360c3101f7a5664d966423
SHA512640c9b9dc2653183c1ab8477688962307ebb73032d1b71caadbe50d530bb4e19ce98095b7f11ae70c7aafc251da68533ba0c9aa52faa7123573a1c1661a09b5a
-
Filesize
283B
MD590f0484dfa4b0d62268e627534de6d17
SHA173b9a68c79aa94b4eb53af9aeb69df7c202cd2f5
SHA25693d72ea06c6548904e9a99f3e538bd8d9e74153ba2ad39c277bf4a043b09f712
SHA5120f1539774ef15b399c07d4161d3da7b9a8ba0dda25287aba06ab8e48b9ff839bb5e793b77ed341efd8a81fd7a8953e5e2251e98bbd609668ea23daad71a22022
-
Filesize
1.4MB
MD57300211c571951be86be6c6f8cdfc09d
SHA15464e16689003406513c7677b3d970f673551d18
SHA256e77c3184d90f6e7a1276bb8389aba06296be97deb2e8a3433ca9a537538696da
SHA5129c340edcd63c87565a9de26892d2e83647798583cc942bf608b54e86b8fd36bc2ad64421241b88f0a0682e7c006a5af712e62d3231ca5a81264d8b1a1905ebb4
-
Filesize
7KB
MD5abd301b0263b0e0cebdd71e4855ac7d3
SHA11e8480c3f3b47a5daa7cb1183b6a7a49998cda6e
SHA256aff003e75bbf410ed2f7ca8728afe01ab4a517536647ad20109d00c4adf570d5
SHA512b5abb188bd23d7fc2e3253a5639cc3eba6d21774dba55b43395cf84ddb49fe707ad54dc0a7f157e6b0804c1662d9c4cb4bef2787aafb194ea73fbebd1a63bb6b
-
Filesize
62KB
MD5b91658597f15d7f689c86f5a2e7824bd
SHA100da609aa0b39140b767a3bc2644433d64edbd71
SHA256b3cda6ab45ad5aa6a0a5f700d2c8987b3c1c1ebda63165d9bd5a566b24dcbd84
SHA51200b287fb14b947edf4b16d52243e9a992595d8894e83d8590473103d1b54a4670b323db13c4f78234617c44f905baf517e68fcceaad313f3ea7cd44cf036daea
-
Filesize
32KB
MD5295832fa6400cb3407cfe84b06785531
SHA17068910c2e0ea7f4535c770517e29d9c2d2ee77b
SHA25613e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784
SHA51250516f9761efd14641f65bd773cfdd50c4ab0de977e094ba9227796dc319d9330321c7914243fc7dc04b5716752395f8dac8ccdfdb98ba7e5f5c1172408ce57b
-
Filesize
12KB
MD551af4120d6d22b1126cc87a5143740ef
SHA11cb4e91e765537a72c9628056d29fbd6a7ce515c
SHA256c74fed62141f7e666379a0b00d5b39c86975332cf08151cbe8cab88eff2c393c
SHA5122595be954684ca34bc9284337524a5191c72fbea46b59555a5113ed8404a1e7ab6c2aa0f5a975f832cccdd8934ff1140c679ecd940f31cc14b4c3a362a225cbc
-
Filesize
76KB
MD52e35d2894df3b691dbd8e0d4f4c84efc
SHA1d0fc14963e397d185e9f2d7dea1d07bc6308d5b9
SHA256869079ba362cbc560d673db290248ec2aa075a74f22a82d90621f1118f8e1c4d
SHA51229ba662ab2e77aef0547ff76213a1b6ef52be27a446923790a27cf8b69377621048387dbb9f22001b6d15837dddada84c7350614ec9622258319658822705f90
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
1.7MB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
88KB
-
Filesize
84KB
-
Filesize
52KB
-
Filesize
1.5MB
-
Filesize
84KB
-
Filesize
52KB
-
Filesize
1.5MB
-
Filesize
84KB
-
Filesize
52KB
