c059e94638ab98773674e1ded446ed4ebe8b0434ce0590bca07f068baa266db7

Sharing

Copy URL Twitter E-mail

General

Target
The.Void.Rains.Upon.Her.Heart.v8.35.zip
Size 726.2MB
Sample260705-sswv4sc19x
SHA256 c059e94638ab98773674e1ded446ed4ebe8b0434ce0590bca07f068baa266db7
MD5 333e8bf63bc9be846b1476d497bcf5f9
SHA1 d8c1a5f1f2a8252767f3510f682c774ed73b8b22
SHA512 59c72ba68677935dd584f5f9c65bbf1095a3424a219f7586b147aeea413130517826f3ee3c9b36c0ac3663e06d6d6c726f52c329a6dc1942229fbc83e51e3800
SSDEEP 12582912:vXFOAiGkhvWnWqmeYst2y++T6q7HqgTJPbvbZJRbKFYEFhx2VSe0GaY5i4ntLLDq:vcZvWnWqmeYsRTT66HqgTJPbvPROFYE1
TLSH
T16D89332671AC460ECD0EB539E1919D0DB83EC02A62ADCFB66319E70E477727604F967C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
- Size 52B
- SHA256 72f4d3e137db5ae8cde66c1b8d000488f16e2ab27a761fe287647010034887cd
- MD5 e2e460fae8682d83a0f080dc3fc6ea99
- SHA1 1f3347c00b7a83709406e7f67659741fffecc48e
- SHA512 a741b7f3c34b46206a6146c34bd01fb71b06de856dc1271ddf13a19e9e1adc85e23aaf3cf690fa17dace117b7db25167916d38383fb50bab1b0ea5bebe81fc03
- TLSH
  T1EA900256451AD0599316084C851195579842219949AAC464D241DB1C588B15485A4708
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/NDP48-x86-x64-AllOS-ENU.exe
- Size 115.7MB
- SHA256 0a3a390c47e639d0f7fc65b21195fee6b7f65b066f80f70c60fab191d14b7e40
- MD5 74d56b9081a42f6315cea96c895cbbcc
- SHA1 ca87b70910f131b625d140ffbfd1c232ea27ab71
- SHA512 a1d1976c85381f3d17ecb4f10cd4d46283ebee5fd4dcfb962a7d617e1db3a83b0709d41243bfe6036788193f64e41040d3c28d55b2dc39e766a933ceccd28d34
- SSDEEP 1572864:jnNsueXwCRTIZPwqGS91CVM6oqgZIzhsinDFrgY/AUkAYrhXbYcFyDr9WWdX5bUV:jqt02qR89gZClDCY/lYlbvFy3b7Nxo
- TLSH
  T10748336F2B7C4520ED0BC73B24D5996144A9C8335B3DCEA6BB185B0A35F8864F4AF835
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/VisualCppRedist_AIO_x86_x64.exe
- Size 27.7MB
- SHA256 de0f71175828f9214494a6f6612bb653d0c023875b8b544556bff84ee4953d96
- MD5 91e79e0543a28b0003ba1801a5132830
- SHA1 00caec42c200e33c87a15b9ae105a977b3a1edde
- SHA512 786775f33a1b2efc06604248261503012ae457a8805f2c1d6fdfc3f189257db116acf13b2420963c68951718af1b957cd8a1a612ba5fc7ac9bb6ddafb1831c4f
- SSDEEP 393216:rV8PuFzZgmwO6R2AIEd3A3Pr9J6SrAYVLMnbu7vB5uBlwBR3i4VZssb3piHVm7/N:x6u6IA/dwjqYVLvuBmBRS7e3MgTN
- TLSH
  T1BE57331231ADFCD2E43521313B33E7D5FB7DED4AA1A4C98A29D01A05627E6273AE13D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/aio_installer.bat
- Size 3KB
- SHA256 f652b2eaef87fcad6ad38a1d41a337028a7353db2568f69a303a579e4d8eb3fc
- MD5 98c016af18a4f654fbb05fc168b9e495
- SHA1 7ae8cb6a197929713d5c635383706af81f31ff2d
- SHA512 252764cb8cb4a6ae34bb222d8995fa8d8701a29d7aa73d4df49a80a0b5d42d6744e76235a10cd2045c96c12afed0488418749862b29e42a1265b79a5ee110387
- TLSH
  T155611C3C340822FDB7719352C53E0682B658A18B4F22BC7470DB9578277AB8468FB4C7
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Common Redist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/Steamworks_x64.dll
- Size 424KB
- SHA256 33467347a808ae51376c5dddc2e355fd252bd135bb56cac8af61b3ae10fd9f30
- MD5 05c12edffe9485eb4c9406790fb01abb
- SHA1 cc12a281e315c18f8c872917428afd4176354605
- SHA512 7fa26ee99e62087f3eeeb5df7f132303bc2abfab9b5cbac2d6cbbc1bd0d7eb2b226f27fe3a2b7e17188fb339ad44548d20a240919b22179cf61642e6add97a02
- SSDEEP 6144:7CpjpZlSKNhNS70CLEKeuM2ZfmmP6VvSOFdutFgy6jRE6D7Fu7tz6:utVNu7+ufhP6kOFYTlIRE28
- TLSH
  T129945A4AF7A410A6D1A79238CE635907E6B37C4B039297CF23A4526E6F37BD0193E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/The Void Rains Upon Her Heart.exe
- Size 7.6MB
- SHA256 f89b264062441a0287d74855880f6ec49b22afc2b1b36fc6d2cc67f40c4ddaff
- MD5 e1539c714a0579d1c3d22bece8356fb9
- SHA1 449c72ac14a44e631e67c6c85fe5ca002dbb2f57
- SHA512 8f66c4fe861d188cc3c2f1f1213d2e27d23120e0bcc1e8415273dc63d87649749fa572bd47f0bbabef0881d3ca449511446dcd21f9a73913f1a2b88dd729f7b4
- SSDEEP 49152:1/wreVJVgIqSPM3Xyd8uA3pj7+T5Q2eXOgUsf5Sga1/cH00aPY+JjAnIK27MQtvp:awI0Ax+iR9C1/cHOPYqjMHSOFM9JZ
- TLSH
  T1E7866B4672A0C1DDD0678039C19666F7E2723C44DF50C7DB6AA07E6C3F73AE449BAA12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/steam_api64.dll
- Size 960KB
- SHA256 78d775496337e6703604f390fed06f52827f17fd030bc7f69a2dc735ab1f8db1
- MD5 bd0070202c2204db83d7821af2ce25da
- SHA1 821e298d63d2b4a52c7d14bc722f6ea04f59323d
- SHA512 dc00a215ef9a26fa2562fd8d38a8d1fd468248893a43f831dd13c9408e7ba22d2cd59701ce1452b4b796424a938fa9f2bacffb0f8c90f46c65e7cdb075c81d1d
- SSDEEP 24576:JpbGG325KVB+kOj1FJYUjrw2/7k8/48Q1QNnrlcMyJfCp:uGwKVw5DYUXRgR1QZrlIfCp
- TLSH
  T11125127A602B1EF8D4B6C4719D563E0F7990018F31515CBE7A808932C6878876FB7ADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/The.Void.Rains.Upon.Her.Heart.v8.35/steam_api64.rne
- Size 288KB
- SHA256 4df999c0c8cb12589f0864d52be5d4c775577aeb27fee28b49b188f9ba083eea
- MD5 500475b20083ccdc64f12d238cab687a
- SHA1 b13f17561a9a0671befbebf0aae7b51bcc0072df
- SHA512 de926d38118c808cde4d3a8f6fde7b56b755ef7938b9adadf0efaac45c853f3d19f4cdd5906b02a7dcca7d2c38b8c01cbd401ce3a7f5e3f9221776f0ed49355b
- SSDEEP 3072:ujTqkh2mB9mkVi635gRaeaZqk4YJDf32uB+rJFC9R+5z65lhTbCz+hnv91vFAyNp:Gb9mZOB3Zx4YUuoaRRFAymC2CPzbN
- TLSH
  T13C545A7AA2710CF4D076C13A88565E0FF670744B23629EFF2A6053369E676C21E3B791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  The.Void.Rains.Upon.Her.Heart.v8.35/_Redist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Checks installed software on the system

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32