Install League of Legends na[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Install League of Legends na.exe
Size 72.0MB
Sample260716-cda24aes5v
SHA256 ceb22b30801f7d011f5a84b48392d30578ddb09a113cfce7b5118b9776f667fe
MD5 9a80c8d5dd4203fa5a1d9c28987b537c
SHA1 77fe0754d920a209671340a1e92cbbc7de905410
SHA512 8958e5239de69a74ef726a8ed4d636437cec8630e2b812159baf232414b44887dc339b9b7c735036bdb78102ec0e74bfb1ff4b73ecf52ec70098bdfae57e3c5e
SSDEEP 1572864:GqX2lSp8d0UNl/Ywrt9E7lzPFUKBBJDIVIbjSp1xe7:Rvp8dnAthBBJDIVRj2
TLSH
T148F7221AB96800E9C4BFD1789E07992BEB71384613249BDB26E0DD651F13AF47E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Install League of Legends na.exe

.exe 72.0MB

Install League of Legends na.exe

IMPHASH c8620c9d9740973791e86edd73e8f612
SHA256 ceb22b30801f7d011f5a84b48392d30578ddb09a113cfce7b5118b9776f667fe
MD5 9a80c8d5dd4203fa5a1d9c28987b537c
SHA1 77fe0754d920a209671340a1e92cbbc7de905410
SHA512 8958e5239de69a74ef726a8ed4d636437cec8630e2b812159baf232414b44887dc339b9b7c735036bdb78102ec0e74bfb1ff4b73ecf52ec70098bdfae57e3c5e
SSDEEP 1572864:GqX2lSp8d0UNl/Ywrt9E7lzPFUKBBJDIVIbjSp1xe7:Rvp8dnAthBBJDIVRj2
TLSH
T148F7221AB96800E9C4BFD1789E07992BEB71384613249BDB26E0DD651F13AF47E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

ef:ea:97:9b:cc:86:14:58:7a:ee:ff:50:88:6f:ce:90:e6:76:0b:87:ec:c8:27:63:08:da:de:e6:65:02:1a:6c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4155843,CN=Riot Games\, Inc.,O=Riot Games\, Inc.,L=Los Angeles,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 5, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

01:53:97:f6:21:77:85:ed:12:69:f9:4e:77:b5:87:74

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 30, 2024 - Dec 4, 2026

Minor OS version

Major OS version

Entry point

8824844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

T:\tmp\Products\Launcher\X64-Public\bin\RiotClientServices.pdb

advapi32

CreateWellKnownSid RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegGetValueW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW SetSecurityInfo BuildTrusteeWithSidW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken AllocateAndInitializeSid CheckTokenMembership FreeSid GetFileSecurityW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation ConvertSidToStringSidA ConvertSecurityDescriptorToStringSecurityDescriptorA RegDeleteKeyW RegDeleteValueA RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW GetEffectiveRightsFromAclW ConvertStringSidToSidW RegDeleteKeyExW AdjustTokenPrivileges LookupPrivilegeValueW SystemFunction036

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateContext CertOpenStore CertCloseStore CertEnumCertificatesInStore

dnsapi

DnsFree DnsQuery_W

gdi32

GetTextExtentPoint32W GetDIBits CreateFontW CreateDIBitmap ExtTextOutW AddFontMemResourceEx RemoveFontMemResourceEx SetBkMode GetTextExtentExPointW CreateCompatibleDC DeleteDC DeleteObject SelectObject SetTextColor CreateDIBSection GetObjectW

gdiplus

GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipBitmapLockBits GdipBitmapUnlockBits

kernel32

GetNativeSystemInfo WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP FreeLibraryWhenCallbackReturns GetLogicalDriveStringsW QueryDosDeviceW IsDebuggerPresent DebugBreak OutputDebugStringW GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress LocalFree FormatMessageW K32GetMappedFileNameW OutputDebugStringA CloseHandle WaitForSingleObject WaitForSingleObjectEx TerminateProcess GetExitCodeProcess CreateThread CreateProcessW GetProcessId OpenProcess VirtualAlloc VirtualFree IsProcessInJob CreateJobObjectW AssignProcessToJobObject TerminateJobObject SetInformationJobObject ReadFile SetEvent CreateEventW GetModuleHandleA GlobalAlloc GlobalLock MultiByteToWideChar CreateFileW FindClose FindFirstFileA FindFirstFileExA FindNextFileA FlushFileBuffers GetFileAttributesExA GetFileSizeEx LockFileEx SetFilePointer SetFilePointerEx UnlockFileEx WriteFile GetTempPathW RaiseException GetProcessTimes GetCurrentProcessId GetCurrentThread GetModuleFileNameW K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFinalPathNameByHandleW GetTempFileNameW RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle DeviceIoControl Sleep GetSystemInfo GetSystemTime GetVersionExW GetPhysicallyInstalledSystemMemory FreeLibrary LoadLibraryW MoveFileExW SystemTimeToFileTime GetFileInformationByHandleEx GetLogicalProcessorInformation VerSetConditionMask GetCommandLineW GetCurrentDirectoryA DeleteFileA GetDiskFreeSpaceA GetFileAttributesA QueryPerformanceCounter QueryPerformanceFrequency GetLocalTime CopyFileW VerifyVersionInfoW WideCharToMultiByte LocalAlloc LoadResource LockResource SizeofResource EnumResourceNamesA QueryFullProcessImageNameW FindResourceA GetUserDefaultLCID InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork SwitchToThread GetExitCodeThread GetLogicalProcessorInformationEx SleepConditionVariableSRW RtlVirtualUnwind ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive InitOnceExecuteOnce GetTickCount MapViewOfFile CreateFileMappingW GetSystemTimeAsFileTime GetFileSize UnlockFile HeapDestroy HeapCompact HeapReAlloc HeapSize HeapValidate UnmapViewOfFile CreateMutexW LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI TryEnterCriticalSection FormatMessageA GetLocaleInfoEx LCMapStringEx CompareStringEx GetCPInfo EncodePointer DecodePointer InitializeCriticalSectionEx IsProcessorFeaturePresent GetEnvironmentVariableA SleepEx GetSystemDirectoryW GetStdHandle GetDiskFreeSpaceExW GetFileInformationByHandle SetFileTime CreateSymbolicLinkW GetCurrentProcessorNumber VirtualQuery GetLargePageMinimum GetNumaHighestNodeNumber GetNumaNodeProcessorMask WriteConsoleA GetConsoleScreenBufferInfo InitOnceBeginInitialize InitOnceComplete GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LoadLibraryExW GetConsoleOutputCP GetConsoleMode GetStringTypeW TlsAlloc TlsGetValue TlsSetValue SetUnhandledExceptionFilter GetTimeZoneInformation InitializeCriticalSectionAndSpinCount TlsFree IsValidCodePage EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ExitProcess SetEnvironmentVariableW SetStdHandle ReadConsoleW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread ExitThread RtlUnwind RtlUnwindEx RtlPcToFileHeader InitializeSListHead GetStartupInfoW UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext SetHandleInformation

ole32

CoInitialize CoInitializeEx CreateStreamOnHGlobal CoUninitialize CoCreateInstance

rpcrt4

UuidCreate

rstrtmgr

RmGetList RmStartSession RmEndSession RmRegisterResources

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteExW

user32

SetWindowLongPtrW LoadCursorW MonitorFromWindow GetMonitorInfoW SendMessageW SetWindowPos GetWindowLongPtrW UnregisterClassW RegisterClassExW CreateWindowExW ShowWindow GetWindowPlacement GetKeyState SetActiveWindow SetWindowTextW SetCursor ScreenToClient GetWindowLongW ReleaseDC GetDC SetForegroundWindow ReleaseCapture SetCapture UpdateLayeredWindow DestroyWindow DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostQuitMessage GetMessageW

ws2_32

getaddrinfo freeaddrinfo WSASetLastError WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAIoctl WSAResetEvent WSASetEvent WSAWaitForMultipleEvents ioctlsocket connect accept __WSAFDIsSet socket getsockname closesocket bind ntohs inet_addr WSACleanup WSAStartup htons htonl WSAGetLastError shutdown getsockopt send select recv ntohl listen inet_pton setsockopt

oleaut32

SysAllocString GetErrorInfo SetErrorInfo SysFreeString SysStringLen

Name

.text

Size

8.9MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

105KB

Virtual Size

329KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60.5MB

Virtual Size

60.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Install League of Legends na.exe

advapi32

bcrypt

crypt32

dnsapi

gdi32

gdiplus

kernel32

ole32

rpcrt4

rstrtmgr

shell32

user32

ws2_32

oleaut32

generic