079eeb7c1e49abdf53fea10fdb19e12ab3d39853b24e56ddac855c6125139441

Sharing

Copy URL Twitter E-mail

General

Target
skyrim-rp-launcher-Setup-1.2.8.exe
Size 164.6MB
Sample260722-fxdtwawshw
SHA256 079eeb7c1e49abdf53fea10fdb19e12ab3d39853b24e56ddac855c6125139441
MD5 ee638ae55ae817ca4af601be8001ad99
SHA1 25ca8276665ddfb4997d922f540c32b40e131015
SHA512 67699c00ae4ca148346ffeac482e60ac7eb8435285405e7dea52aee68472015f1f7ddda5637270a80510d3a492cb51c02159c1b35075464e35b8427963a12868
SSDEEP 3145728:T2ksySkWrIivNLajYFC+hogndCY1x6mRIvkTBx1EUWFx/3voqG55cf6mxdaGyauB:6LQUVNLaaC+howdCQLRIsF32Fx/3vK5t
TLSH
T16F8833D43E18C127CBED5C31890FA30E92F477D09A8079BB5C0B26F9FAD4691BE465A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  skyrim-rp-launcher-Setup-1.2.8.exe
- Size 164.6MB
- SHA256 079eeb7c1e49abdf53fea10fdb19e12ab3d39853b24e56ddac855c6125139441
- MD5 ee638ae55ae817ca4af601be8001ad99
- SHA1 25ca8276665ddfb4997d922f540c32b40e131015
- SHA512 67699c00ae4ca148346ffeac482e60ac7eb8435285405e7dea52aee68472015f1f7ddda5637270a80510d3a492cb51c02159c1b35075464e35b8427963a12868
- SSDEEP 3145728:T2ksySkWrIivNLajYFC+hogndCY1x6mRIvkTBx1EUWFx/3voqG55cf6mxdaGyauB:6LQUVNLaaC+howdCQLRIsF32Fx/3vK5t
- TLSH
  T16F8833D43E18C127CBED5C31890FA30E92F477D09A8079BB5C0B26F9FAD4691BE465A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 10.6MB
- SHA256 393265e3de728882557aa57b02ad5cba340bc693e846a6ee6dae1a749bd4bb48
- MD5 ce7b3e43b094f60dc5bdea5490f75c99
- SHA1 0225f9e489ef1ece3bb4d981e56f076a6da15564
- SHA512 1179b9939ece51507e0e5f450d88759bd46ea9139dd4c2cb671fcf6bb8d861ddf8881fe268e2bcc59e3450677c00e6c0be430b3c7cf224660d3e7bfec7c4c56a
- SSDEEP 24576:s89dQ06poh6j5qjK6mwRlXTimf6jZ6ojK6QjZ6UjK6ajK64jK6ZjZ6ijK6e6cjKI:78eGf
- TLSH
  T19EB6A42F7B48037706C602A2AB8B65CAF31F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 6f20c9ec7ea72f7fe87b0f199db7892a64687ba3edbeef49bfc631c616569711
- MD5 a84cb2f493a10d414492570c9ab7523e
- SHA1 0d12bbb0050fcb985a0c3dd5f06ca2239e4de82b
- SHA512 d1730c52f5dd303046440d50362b4bfd2c28d82203f977ba5be8aa4eb05a9b1fb91dec1278d58cafc54cf37919f1f11c0d19ad3d5d0a2c5116af19129b22c270
- SSDEEP 49152:viWa61V7iv3L5LlZ1rpkKzYNOA/7ZnddK6BfeLaSHAIeSR3KTw8:qGev3LFbgKzYggIe8K88
- TLSH
  T1B6D5BE03F6DA50DDD029D470979F9213F671344A8F1166EF26A05A202FA7FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libEGL.dll
- Size 479KB
- SHA256 445791e93b3677efae8e88f8e69dc616af1bdba1a9265d893c42ed7e00aa38c8
- MD5 06935b383ce745f025a31550f97c77c5
- SHA1 8922c3d152287c7a82722f21737e843c85771bd9
- SHA512 440d488a067ff42fb3d7052bf1b999aaa9ed9b41067ea88d797749fe8d14b5d2cd051379b1c419e5b03532e463a6c146ed9c6112dbf323d6261195d8492a5852
- SSDEEP 6144:qpf5tkRT05pU+7XmpChszWpTRY6CIczyj+ww4NZ96pRO:Kx537XQChszIzCLyj+ww4Ir
- TLSH
  T10CA49E15B3E444A9E06AD174CA534642DB76B4960B29FBDF03E492392F37BF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 097c8df76bb18b926396545c7803aa2f6910c2b5fda39ed6a5a93d4b5337b08c
- MD5 98be8613f3b8c392e5f83ca1f0be0653
- SHA1 410de415313af460821614adbc8eb578d4cc8f58
- SHA512 7d593cd3be18757f0bfb600dcf577962447446e04ca036b24083347b72081df6ac9816f7db3ac79cba7666fe006704b225f316f69480fca8ede21c5725173cf0
- SSDEEP 98304:Rq/cBzNls5GKtT8jbjevNn+y+vrrXgJooioooooooooooooooooorooooooooInH:R/sAMV+n4H
- TLSH
  T172867C03F79640D9D00DE2B8C75B9623FA3578850724B6CF269457252F67FE0AB3AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/@tailwindcss/oxide/node_modules/@tailwindcss/oxide-win32-x64-msvc/tailwindcss-oxide.win32-x64-msvc.node
- Size 2.9MB
- SHA256 219577e5e27f01c2947c882fba1b10865d9a51d4eb13fb53ddebbf21b888cc13
- MD5 ef61108bfe20f352e59718035dc87121
- SHA1 1058ead005a3a2b2a30a2d69380fe55fa72e0717
- SHA512 13077b5d879311735e34f9ddd62c2d1613b7b9c68150b8cef5f3ad02eae2d20f0973c542655fed8c7755fbf814509ad1f998c19b5b5d90ac994b7766269651e6
- SSDEEP 49152:MoM6BBtsGkpX80biOeSnjU0SsxwPRnIxX/KSTf+td+XvrZe1S:Tlmp/8SkwrZe1S
- TLSH
  T1ABE52912BA9799ADC59EC87083474A735A21B4CB0B26BAFF41C445353F69BF01B3C768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/lightningcss/node_modules/lightningcss-win32-x64-msvc/lightningcss.win32-x64-msvc.node
- Size 8.1MB
- SHA256 a27114f832a9897b04be88fa8d2103e6058aa11712984cfa29f1360691d7dded
- MD5 045ca62b8930baee43bf05566d538e99
- SHA1 f8fd7887cdb8c6b1adc86c59727296a83277c064
- SHA512 d242b8f12d2136d9680ef16c14a0581c120f8e162b04b59c58a6a029139bbcb9b5fef903674f59e29e5e8c970f84fc2b175d7a5f699c6dde872588423813329b
- SSDEEP 98304:Bd9KvnKVi4QijoWRLCfT3gai7ccWUea7gS:9sT3gIAgS
- TLSH
  T1B3860807E2B281D9C46DC97583667233FB717C8986247AE74BE05F322F25F90A62D706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  skyrim-rp-launcher.exe
- Size 181.7MB
- SHA256 a7557dddf38c374ccbe45e3d0860b0cbdfa2fc47a4e0586186b7ae97a81375f5
- MD5 723830999baef1e43812adba67e159c5
- SHA1 a066c5cabcd6217a0e83163d88b3aff1417abfab
- SHA512 6cd1dce6b5fc85c58a97672c6587388efe5ed52a92643d172d64af6734813cf86491c3e3666fac46bf337a2989e2181639624152a7c0db9b362963b05fc51351
- SSDEEP 1572864:6S2Pu1Jj0OuGO8cXSR3XO8ioGbWAhaEmtQ5cG9iJ1EKeulnYhE3jpOdSzVzyJO4j:sRo+CbtS4d7
- TLSH
  T1B4988C03F39A00D9E05DD1758B4B9633EAB1B8854728A2DF2B5407562F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 a85b3efaad42ceddd2a8432ec42fd49d364f95e3b176f9c23ac528969c6ffb4e
- MD5 69248fb69d2a7724c309d36c3224d1ff
- SHA1 876fdab22b4ed34c0cf4fcd548d23fe390055802
- SHA512 ab3019e23cb1666867cc21a17836e444510aff720e6849f64a241e33308699dcbaf45bcc3a58fed4120cb5af6a62539cae3a00d739a27c1641ffd5c7ff02c07c
- SSDEEP 49152:CjtHPuQzKxUDrpspreFRHmrR5zLIOrzY/9G75d/9N4yyUGrWrw+/1SbJ/E06922i:OGQzcXpovSnXTk
- TLSH
  T1BD463803B2858099F05DD679875BA633F632B8801B76B6DF52A01F192E77FE06739B01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  vulkan-1.dll
- Size 876KB
- SHA256 b302a11558a4afda5b1529bdc0984ba7705faa36ad2bdfc0fef140c8b1e2f449
- MD5 cd5699901c78e2e698cb4fc988672106
- SHA1 1662f5c62411659080a7870e67fa7afd1b850741
- SHA512 d2aebf21a73c1c7d35e98852c996e579390d724ad65eeaa072dbf38cc0b99ae615e6e94af05e09ce66852605b6fa9110496fc26f79699b42c3a802c9d345a831
- SSDEEP 24576:Rx2LdDMxavyLgu/QYkiawQV6Z5W4DYsHF6g3P0zAk7ooU:RcL+xa67/QYQwQV6Z5W4DYsHF6g3P0zO
- TLSH
  T100156C23E6948669D57AC034C9C24603C9F174922326B9CF02A85718BF6BFF47B7DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  $R0/Uninstall skyrim-rp-launcher.exe
- Size 153KB
- SHA256 9b5ff4827f8e1bd724822e937164f418c33d102bbb34bb24155947de18489a55
- MD5 9cc0da6ed3d37f3e86468d1bef8b99bc
- SHA1 0f1e0639f05b3a1b51599d000929e4fbf46c2aa4
- SHA512 81c00c35c8b89d41ca12c86d86aed03645eedbd23ad0d8c4520085c3e389e899b6a21376b5f06dd38322f32ecd1a0baf1b842661b757d64805cec744e48771ee
- SSDEEP 3072:sn77v00hEoDEtauTpUc5vMgoery6+FSyUYH7aH2tvhOEA1RJCir86SrSrv6Ia3k:s740IDpU0vMgbm6ESyUus2t0EyL+ya0
- TLSH
  T14DE30100BBD0C093E6F70F710AF697AB5EB6F11224685F4B77C4264D79A26D19E0E782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

Checks computer location settings

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32