Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 17:17
General
- Target Install-KAMI 2-GooglePlayGames.exe
- Size 39.4MB
- Sample260815-vtqrlagh46
- SHA256 db8097320abffaad7b97569c84f173f182ee350002dc5a98ef8b6762f1a92030
Malware Config
Signatures
- Drops file in System32 directory 16 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 36 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install-KAMI 2-GooglePlayGames.exe"C:\Users\Admin\AppData\Local\Temp\Install-KAMI 2-GooglePlayGames.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bcrew2cj.xw5\crashpad_handler.exeC:\Users\Admin\AppData\Local\Temp\bcrew2cj.xw5\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=26.5.634.0 --initial-client-data=0x78c,0x790,0x794,0x758,0x798,0x7ffe2e3df8a0,0x7ffe2e3df8b0,0x7ffe2e3df8c02⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\dxdiag.exe"C:\Windows\System32\dxdiag.exe" /t "C:\Users\Admin\AppData\Local\dxdiag.log"2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
CrashReporting.dll
crashpad_handler.exe
installer_phenotype_delegate_lib.dll
recorder_delegate_lib.dll
dxdiag.log
memory/2000-99-0x0000020C5A710000-0x0000020C5A711000-memory.dmp
memory/2000-95-0x0000020C5A710000-0x0000020C5A711000-memory.dmp
memory/2000-96-0x0000020C5A710000-0x0000020C5A711000-memory.dmp
memory/2000-90-0x0000020C5A710000-0x0000020C5A711000-memory.dmp
memory/2000-88-0x0000020C5A710000-0x0000020C5A711000-memory.dmp
memory/2000-98-0x0000020C5A710000-0x0000020C5A711000-memory.dmp
memory/2000-97-0x0000020C5A710000-0x0000020C5A711000-memory.dmp
memory/2000-94-0x0000020C5A710000-0x0000020C5A711000-memory.dmp
memory/4204-48-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-73-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-24-0x0000028D5F980000-0x0000028D5F992000-memory.dmp
memory/4204-20-0x0000028D465F0000-0x0000028D46606000-memory.dmp
memory/4204-19-0x0000028D5F670000-0x0000028D5F762000-memory.dmp
memory/4204-18-0x0000028D5EE00000-0x0000028D5EE7E000-memory.dmp
memory/4204-26-0x0000028D5FA80000-0x0000028D5FB3A000-memory.dmp
memory/4204-17-0x0000028D46490000-0x0000028D464B6000-memory.dmp
memory/4204-15-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-9-0x0000028D463F0000-0x0000028D46406000-memory.dmp
memory/4204-8-0x0000028D5F2E0000-0x0000028D5F468000-memory.dmp
memory/4204-27-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-28-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-35-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-36-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-37-0x0000028D64910000-0x0000028D64918000-memory.dmp
memory/4204-45-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-44-0x0000028D64960000-0x0000028D6496E000-memory.dmp
memory/4204-46-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-23-0x0000028D5F900000-0x0000028D5F97A000-memory.dmp
memory/4204-51-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-0-0x00007FFE2A8EF000-0x00007FFE2A8F0000-memory.dmp
memory/4204-43-0x0000028D656C0000-0x0000028D656FE000-memory.dmp
memory/4204-21-0x0000028D46610000-0x0000028D46618000-memory.dmp
memory/4204-53-0x0000028D66390000-0x0000028D66406000-memory.dmp
memory/4204-22-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-16-0x0000028D46480000-0x0000028D4648C000-memory.dmp
memory/4204-61-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-72-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-25-0x0000028D5F990000-0x0000028D5F9B6000-memory.dmp
memory/4204-74-0x0000028D67060000-0x0000028D671E8000-memory.dmp
memory/4204-75-0x0000028D66ED0000-0x0000028D66ED6000-memory.dmp
memory/4204-76-0x0000028D66EF0000-0x0000028D66F1E000-memory.dmp
memory/4204-77-0x0000028D66F20000-0x0000028D66F28000-memory.dmp
memory/4204-78-0x0000028D66F90000-0x0000028D66FD6000-memory.dmp
memory/4204-79-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-80-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-81-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-82-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-83-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-84-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-85-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-86-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-87-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-14-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-10-0x0000028D44B80000-0x0000028D44B88000-memory.dmp
memory/4204-11-0x0000028D44C30000-0x0000028D44C3A000-memory.dmp
memory/4204-12-0x0000028D46410000-0x0000028D46470000-memory.dmp
memory/4204-13-0x0000028D46470000-0x0000028D46480000-memory.dmp
memory/4204-6-0x0000028D44B70000-0x0000028D44B7A000-memory.dmp
memory/4204-7-0x0000028D44C00000-0x0000028D44C2A000-memory.dmp
memory/4204-5-0x0000028D44B60000-0x0000028D44B6A000-memory.dmp
memory/4204-4-0x0000028D5EE90000-0x0000028D5F2E2000-memory.dmp
memory/4204-3-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-2-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-178-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/4204-1-0x0000028D43DD0000-0x0000028D446E6000-memory.dmp
memory/4204-182-0x0000028D674B0000-0x0000028D675B2000-memory.dmp
memory/4204-181-0x0000028D67350000-0x0000028D67392000-memory.dmp
memory/4204-183-0x0000028D675C0000-0x0000028D6785E000-memory.dmp