Seamless Co-op v1.9.9-510-1-9-9-1776812412.zip
- SHA256 95e9db8fcec02c9148eee42d0d20234eae0729ded5f91b2bedb17d84037e0dfa
Behavioral task
behavioral1
Sample
SeamlessCoop/crashpad/crashpad_handler.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SeamlessCoop/crashpad/crashpad_handler.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SeamlessCoop/ersc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
SeamlessCoop/ersc.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
ersc_launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
ersc_launcher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Seamless Co-op v1.9.9-510-1-9-9-1776812412.zip
- Size 4.4MB
- Sample260801-1a36gaxcmd
- SHA256 95e9db8fcec02c9148eee42d0d20234eae0729ded5f91b2bedb17d84037e0dfa
- MD5 f3594dce6e19b43f014e61ef8493ce88
- SHA1 ac7692fefd61f912c9a581c06cf256fc7b126deb
- SHA512 aec53f5d60f4566d2f03d6d79540cd24995483b732cfb76e1e0a74ba6362822b18e7ead7ab5f9723adfbffae1c0074ad1d229ce37f1a12e2e73f2ceedd6003ad
- SSDEEP 98304:oZGBFR5myLJNRCndrF4oN8J5iCnlaewPGZ4sb8fv4kFB71hEzOBB0WuLr4:oZa9mkJydrF4oMBnMeSGasb8vDFBmO4O
- TLSH T16B2633E475C47C96FBCD71BACE576D80CA0E9F5A9B858BA10B49E3BFBD84004489352C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/SeamlessCoop/ersc.dll themida - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/SeamlessCoop/crashpad/crashpad_handler.exe unpack001/SeamlessCoop/ersc.dll unpack001/ersc_launcher.exe
File Explorer
-
Seamless Co-op v1.9.9-510-1-9-9-1776812412.zip.zip 4.4MB
-
SeamlessCoop/crashpad/crashpad_handler.exe.exe 805KB
-
SeamlessCoop/ersc.dll.dll 7.4MB
-
SeamlessCoop/ersc_settings.ini2KB
-
SeamlessCoop/locale/english.json9KB
-
ersc_launcher.exe.exe 171KB
SeamlessCoop/crashpad/crashpad_handler.exe
- IMPHASH 9f6e61c22777af70323494d32383223d
- SHA256 d799b428ecc200a47b08b27f6b33ed5fe1f1e065136f380f6a6e78088c404649
- MD5 3ec03507fc8a9e09a4e26a10efadad32
- SHA1 424485b95dc7d9f3073f401fcb85b155a6f1d62b
- SHA512 d06605a9829ead68ba54ae796b199144cb8a1e6586fd5c304847abb07f98b2daf4dd8f75d9535bc8128953c4eaf841a7ae77e22d9cf5480f7db481f11c332fc8
- SSDEEP 24576:XyNu7wTizsQCoAe+HhJGs7GT+1sr+2t1t:XvwWzRCoAbJlqT
- TLSH T124057C5FA37841FCC0BBD13899475907E6B6B80A437066DB13D046A63F23AE4AE7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
430720
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Luke\crashpad\crashpad\out\Default\crashpad_handler.pdb
kernel32
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
SetLastError
GetModuleFileNameW
GetFileInformationByHandleEx
GetCurrentProcess
RegisterWaitForSingleObject
TerminateProcess
GetQueuedCompletionStatus
WaitForSingleObject
DuplicateHandle
DisconnectNamedPipe
OpenProcess
PostQueuedCompletionStatus
CreateEventW
SetEvent
CreateThread
UnregisterWaitEx
CreateIoCompletionPort
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CreateFileW
GetVersion
TransactNamedPipe
WaitNamedPipeW
LoadLibraryW
GetProcAddress
FindClose
CloseHandle
ReleaseSemaphore
CreateSemaphoreW
ReadFile
GetFileSizeEx
GetStdHandle
WriteFile
EnterCriticalSection
UnlockFileEx
SetFilePointerEx
LockFileEx
GetFileType
GetModuleHandleW
FormatMessageA
LocalFree
CreateDirectoryW
GetFileAttributesW
DeleteFileW
GetTimeZoneInformation
GetSystemInfo
IsProcessorFeaturePresent
VerSetConditionMask
VerifyVersionInfoW
GetProcessId
Wow64GetThreadContext
SuspendThread
ResumeThread
GetThreadContext
GetProcessTimes
GetSystemDefaultLCID
GetThreadLocale
GetUserDefaultLCID
IsWow64Process
Sleep
RaiseException
CreateProcessW
SleepEx
GetFullPathNameW
GetCurrentProcessId
GetLocalTime
OutputDebugStringW
GetLastError
FormatMessageW
GetCurrentThreadId
SetUnhandledExceptionFilter
SetProcessShutdownParameters
SetEndOfFile
GetCurrentDirectoryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
InitOnceExecuteOnce
InitializeCriticalSection
VirtualQueryEx
ReadProcessMemory
GetFileTime
RemoveDirectoryW
WriteConsoleW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
WideCharToMultiByte
InitOnceComplete
InitOnceBeginInitialize
InitializeCriticalSectionEx
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RtlUnwindEx
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
GetCommandLineA
GetCommandLineW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapReAlloc
FindFirstFileExW
FindNextFileW
advapi32
SystemFunction036
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
BuildExplicitAccessWithNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildSecurityDescriptorW
RevertToSelf
ImpersonateNamedPipeClient
user32
TranslateMessage
RegisterClassW
DispatchMessageW
GetWindowLongPtrW
UnregisterClassW
CreateWindowExW
SetWindowLongPtrW
DestroyWindow
PostMessageW
DefWindowProcW
GetMessageW
winhttp
WinHttpWriteData
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpConnect
powrprof
CallNtPowerInformation
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Name
.text
Size
595KB
Virtual Size
595KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
CPADinfo
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=29395,
count=172, id=261, version=29395,
count=18, id=260, version=29395,
count=17, id=260, version=31823,
count=82, id=261, version=31823,
count=12, id=259, version=31823,
count=13, id=257, version=29395,
count=207, id=1, productName=Unmarked objects,
count=1, id=259, version=31937,
count=142, id=265, version=31937,
count=1, id=258, version=31937,
SeamlessCoop/ersc.dll
- SHA256 b34da36f537dfce14551e1083c5f19ce7e33d8235034ef03cd549de4a9107594
- MD5 9e3d89740a78e7820015051ebe6e09b7
- SHA1 3f7aa41e79e243648fcb4f20737698351ea315fd
- SHA512 c078e9846a947c670bb4ea022ab63fafc4351bf9a780f2e523ee00f3b2aee7f6312841205d9dc43b5f5eae8908f694455a62440392ebd37a4406e667b231cf6c
- SSDEEP 98304:GY8iOLp3IFhYhzrsHf1BZDOWAFWBy7wLlfhhRLJKeWXE:X8nLxISzr2ftOWhychJhR9xW0
- TLSH T15A766CA376D2E4EEC31ACCF4C952B52F9BD27C6A171D71974552F35CA733A682228B00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3191680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
modengine_ext_init
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
533KB
Virtual Size
532KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
140B
Characteristics
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
SeamlessCoop/ersc_settings.ini
- SHA256 10cda8bc8ec0c456541530ec8d11028cd1688640698a2dd4099ac5c114529c46
- MD5 15ada07b9eeb9256a53bbfaa12cb1e7b
- SHA1 0c0a2f4c337dc34e6d9ff824b1658e70a1328b8f
- SHA512 1c121b102a0825e08c86f4e8920ff2f0fdab5db4549842f2bbd580fb447645b38965020cc8a8d38427ceb0e19dae26a55ee57d1276b69ee0e92eddbb221ac578
- TLSH T1704168BD1ABE04AD241793D4B84A240673B8491885F83E1AF45D283C729DB5D42BE67D
- MD5 SHA1 SHA512 TLSH
SeamlessCoop/locale/english.json
- SHA256 b8d5d3db86365a6b5e78ce888934d6fdc8308ffef3e1ae22fde24c2a18d90f3b
- MD5 dcc6ee8abc16fa2255c560851ea14772
- SHA1 5fd3d3e7d9a596e2f4af931e810c990e942c4cd3
- SHA512 d3af3d6fc3fae818401ef466d7b51febbdbeba98acbb2d38842f8871fcf214c04d72d8d6abbf86b7b0296fd5a8b7a6000e54f930f8721e291d54ebaba418afdf
- SSDEEP 192:6EjymABw7Rk14tfbjUr8kz8YGEoYCsblkKVc87chkuesg7+ksM4HxvlzX:LGpwpUr8kz8YGEoYCsblkKVcEchkuesZ
- TLSH T10A12742D9F21132F1567868CB83D49D1E63EA465872C23D894AEC0B0F9E6914527F7BC
- MD5 SHA1 SHA512 SSDEEP TLSH
ersc_launcher.exe
- IMPHASH f0636e24b38d9a02e5a0027d5127e5df
- SHA256 e005b67d0d1d594e1e0571243c3f94acc4e1bb7bfc48af76bad1d1a85b43368b
- MD5 f011e153cac3177b276dfc2eaee69cf1
- SHA1 fa27227c23e4934749e2681c883d4193d0c18e3c
- SHA512 4c27ba4b31d1dad26ee6d6a3603aafd42cbe9e6e7a964bea9aa40470f8e6783a98295582d1c3f6124421f1b24c6867dd7dbb3203a98aa7312d14d3e1c8e97cf0
- SSDEEP 3072:+JHq10wQpdqZmRntpAp0bjG3JLoaEQjbV/2QGpoDwaQSJWE4k6hg8BNuZIlio+Tj:+Bq10wQpdqZmRntpAp0bjeJLoaEQjbV1
- TLSH T1050452E059A0F4CBF354887580F4EBFF46B9793A1E45414329FAB2DCAB1AB7C5C61212
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7868
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Luke\source\repos\ersc\x64\Release\ersc_launcher.pdb
kernel32
CloseHandle
CreateFile2
CreateProcessA
CreateRemoteThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFullPathNameA
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
K32EnumProcessModules
K32GetModuleFileNameExA
OpenProcess
QueryPerformanceCounter
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEnvironmentVariableA
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
VirtualAllocEx
VirtualFreeEx
WaitForSingleObject
WriteProcessMemory
vcruntime140
_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
memcpy
memset
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vfprintf_s
__stdio_common_vfwprintf_s
_set_fmode
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_c_exit
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
exit
system
terminate
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strcmp
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
564B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
92B
Characteristics
Name
.rsrc
Size
155KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ