Analysis
- max time kernel
300s - max time network
282s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 01:53
General
- Target Install-Survival RPG_ Mundo Abierto 2D-GooglePlayGames.exe
- Size 39.4MB
- Sample260816-ca7a5aaf94
- SHA256 b4dfc878ee92557b05ef46c8e974eef838374175186c1fb6ca4a460d229f33b6
Malware Config
Signatures
- Drops file in System32 directory 16 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 35 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install-Survival RPG_ Mundo Abierto 2D-GooglePlayGames.exe"C:\Users\Admin\AppData\Local\Temp\Install-Survival RPG_ Mundo Abierto 2D-GooglePlayGames.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hva1virs.3pd\crashpad_handler.exeC:\Users\Admin\AppData\Local\Temp\hva1virs.3pd\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=26.5.634.0 --initial-client-data=0x6fc,0x700,0x704,0x6d8,0x708,0x7ff9cd0df8a0,0x7ff9cd0df8b0,0x7ff9cd0df8c02⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\dxdiag.exe"C:\Windows\System32\dxdiag.exe" /t "C:\Users\Admin\AppData\Local\dxdiag.log"2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
CrashReporting.dll
crashpad_handler.exe
installer_phenotype_delegate_lib.dll
recorder_delegate_lib.dll
dxdiag.log
memory/4140-84-0x000001F735800000-0x000001F735801000-memory.dmp
memory/4140-175-0x000001F735690000-0x000001F735741000-memory.dmp
memory/4140-90-0x000001F735800000-0x000001F735801000-memory.dmp
memory/4140-91-0x000001F735800000-0x000001F735801000-memory.dmp
memory/4140-92-0x000001F735800000-0x000001F735801000-memory.dmp
memory/4140-94-0x000001F735800000-0x000001F735801000-memory.dmp
memory/4140-95-0x000001F735800000-0x000001F735801000-memory.dmp
memory/4140-93-0x000001F735800000-0x000001F735801000-memory.dmp
memory/4140-86-0x000001F735800000-0x000001F735801000-memory.dmp
memory/5076-46-0x000001E146400000-0x000001E146408000-memory.dmp
memory/5076-63-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-21-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-17-0x000001E140F00000-0x000001E140F7E000-memory.dmp
memory/5076-24-0x000001E141480000-0x000001E1414A6000-memory.dmp
memory/5076-25-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-23-0x000001E140870000-0x000001E140882000-memory.dmp
memory/5076-22-0x000001E141400000-0x000001E14147A000-memory.dmp
memory/5076-16-0x000001E140ED0000-0x000001E140EF6000-memory.dmp
memory/5076-15-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-10-0x000001E1406D0000-0x000001E1406DA000-memory.dmp
memory/5076-9-0x000001E1406C0000-0x000001E1406C8000-memory.dmp
memory/5076-8-0x000001E127E70000-0x000001E127E86000-memory.dmp
memory/5076-7-0x000001E140CE0000-0x000001E140E68000-memory.dmp
memory/5076-26-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-27-0x000001E141570000-0x000001E14162A000-memory.dmp
memory/5076-28-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-29-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-31-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-19-0x000001E140700000-0x000001E140716000-memory.dmp
memory/5076-47-0x000001E1471B0000-0x000001E1471EE000-memory.dmp
memory/5076-48-0x000001E146450000-0x000001E14645E000-memory.dmp
memory/5076-49-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-50-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-51-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-52-0x000001E147EA0000-0x000001E147F16000-memory.dmp
memory/5076-60-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-61-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-62-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-18-0x000001E141180000-0x000001E141272000-memory.dmp
memory/5076-64-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-65-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-66-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-67-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-68-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-69-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-70-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-78-0x000001E1489D0000-0x000001E1489D6000-memory.dmp
memory/5076-79-0x000001E1489F0000-0x000001E148A1E000-memory.dmp
memory/5076-80-0x000001E148A20000-0x000001E148A28000-memory.dmp
memory/5076-81-0x000001E148BD0000-0x000001E148D58000-memory.dmp
memory/5076-82-0x000001E148DB0000-0x000001E148DF6000-memory.dmp
memory/5076-20-0x000001E140740000-0x000001E140748000-memory.dmp
memory/5076-11-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-14-0x000001E1406F0000-0x000001E1406FC000-memory.dmp
memory/5076-12-0x000001E140E70000-0x000001E140ED0000-memory.dmp
memory/5076-13-0x000001E1406E0000-0x000001E1406F0000-memory.dmp
memory/5076-5-0x000001E127E60000-0x000001E127E6A000-memory.dmp
memory/5076-6-0x000001E140690000-0x000001E1406BA000-memory.dmp
memory/5076-4-0x000001E127E50000-0x000001E127E5A000-memory.dmp
memory/5076-3-0x000001E140890000-0x000001E140CE2000-memory.dmp
memory/5076-2-0x000001E1258C0000-0x000001E1261D6000-memory.dmp
memory/5076-1-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp
memory/5076-0-0x00007FF9CA3BF000-0x00007FF9CA3C0000-memory.dmp
memory/5076-83-0x000001E148BB0000-0x000001E148BB8000-memory.dmp
memory/5076-177-0x000001E148E40000-0x000001E148E80000-memory.dmp
memory/5076-178-0x000001E148F90000-0x000001E149092000-memory.dmp