Overview
overview
7Static
static
3WAR Battle....1.exe
windows10-2004-x64
7WAR Battle....1.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3WAR Battle Beta.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1locales/mr.ps1
windows10-2004-x64
3locales/mr.ps1
windows11-ltsc_2024-x64
3resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows11-ltsc_2024-x64
3resources/...fi.dll
windows10-2004-x64
1resources/...fi.dll
windows11-ltsc_2024-x64
1resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows11-ltsc_2024-x64
3resources/...oop.js
windows10-2004-x64
3resources/...oop.js
windows11-ltsc_2024-x64
3resources/...i.node
ubuntu-18.04-amd64
1resources/...i.node
ubuntu-18.04-amd64
1resources/...i.node
ubuntu-18.04-amd64
1resources/...pi.dll
windows10-2004-x64
1resources/...pi.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 17:18
Static task
static1
Behavioral task
behavioral1
Sample
WAR Battle Beta Setup 1.0.0-beta.1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
WAR Battle Beta Setup 1.0.0-beta.1.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
WAR Battle Beta.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
locales/mr.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
locales/mr.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/@koromix/koffi-win32-x64/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/@koromix/koffi-win32-x64/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/@koromix/koffi-win32-x64/win32_x64/koffi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/@koromix/koffi-win32-x64/win32_x64/koffi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/uiohook-napi/dist/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/uiohook-napi/dist/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/uiohook-napi/dist/prebuild-test-noop.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/uiohook-napi/dist/prebuild-test-noop.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/linux-arm64/uiohook-napi.node
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/linux-loong64/uiohook-napi.node
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/linux-x64/uiohook-napi.node
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/win32-x64/uiohook-napi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/win32-x64/uiohook-napi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target WAR Battle Beta.exe
- Size 192.0MB
- Sample260804-vveeysec33
- SHA256 a4f4b683e5efe92324ba73c230713a2a9a46409084a48b704401d9cad6c95555
- MD5 615f7258f17c3533e017cab9367361e9
- SHA1 1f24138650d77f175d5234f7f9cce198adfeb769
- SHA512 95ec8bfd9b4bca62938cabbfadc8886de5240ace820c83397142877d58bd02ea738eb5d1382aebb6950db4ab7985889b870b38e471fc4fcdf29bd901fb91a20c
- SSDEEP 1572864:uhqI5OOengTDlkGf97McvHp/i8mhllqtSIOr3alJsxjEP6H5HlTShW62Su+709x5:TOMMpBKvPTJJlf
- TLSH T147A88C03F39A50D9E01DD1759B479633EAB1B88A4324A2DF2B5407912F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation WAR Battle Beta.exe Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation WAR Battle Beta.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1040 WAR Battle Beta.exe 1040 WAR Battle Beta.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5004 WAR Battle Beta.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe Token: SeShutdownPrivilege 5004 WAR Battle Beta.exe Token: SeCreatePagefilePrivilege 5004 WAR Battle Beta.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5004 WAR Battle Beta.exe 5004 WAR Battle Beta.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4008 5004 WAR Battle Beta.exe 85 PID 5004 wrote to memory of 4008 5004 WAR Battle Beta.exe 85 PID 5004 wrote to memory of 3304 5004 WAR Battle Beta.exe 86 PID 5004 wrote to memory of 4648 5004 WAR Battle Beta.exe 87 PID 5004 wrote to memory of 4648 5004 WAR Battle Beta.exe 87 PID 5004 wrote to memory of 3656 5004 WAR Battle Beta.exe 88 PID 5004 wrote to memory of 3656 5004 WAR Battle Beta.exe 88 PID 5004 wrote to memory of 1040 5004 WAR Battle Beta.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe"C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe"C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\war-battle-beta" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1768,i,9690832542763613357,16846354078573508195,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:22⤵PID:4008
-
-
C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe"C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\war-battle-beta" --field-trial-handle=1768,i,9690832542763613357,16846354078573508195,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:32⤵PID:3304
-
-
C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe"C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\war-battle-beta" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1768,i,9690832542763613357,16846354078573508195,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:12⤵
- Checks computer location settings
PID:4648
-
-
C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe"C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\war-battle-beta" --field-trial-handle=1768,i,9690832542763613357,16846354078573508195,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:82⤵PID:3656
-
-
C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe"C:\Users\Admin\AppData\Local\Temp\WAR Battle Beta.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\war-battle-beta" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1768,i,9690832542763613357,16846354078573508195,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=900 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1040
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\war-battle-beta\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\war-battle-beta\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\war-battle-beta\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\war-battle-beta\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP