ebc01b26c5831bb276037cc2b0c02c2c2429fa8cdabda90da34b37fd7e9b8f84

General

Target
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywsl.exe
Size 38KB
Sample261006-vc2grsssez
SHA256 ebc01b26c5831bb276037cc2b0c02c2c2429fa8cdabda90da34b37fd7e9b8f84
MD5 11680fd4153728748aec59635ce8ae64
SHA1 def650c8396679ca36e867433f605df8b2c0d562
SHA512 5c4b9a1f0dfa8997ddb45f572790b5fd0ff04b474f7dda9ef3636794f3f01789873a0a1f2654776ca2bd2950faedff17d091d8e3d80753c063b4500ecc2384a5
SSDEEP 768:2+m/j/+FywJHOTMtU01nJa2I/fREJ8daUFCcSmEmYJ/pbBQ7Bo++W:2lOTR1nMT5EezFJPK/ptAKHW
TLSH
T1AE03F1A3EA36A825C93C527D52EFD2B173DD6E9487BEC3431B597839201D5E52C0A133
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4752	S0UG0U.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\i:\	S0UG0U.exe
\??\m:\	S0UG0U.exe
\??\s:\	S0UG0U.exe
\??\d:\	S0UG0U.exe
\??\e:\	S0UG0U.exe
\??\k:\	S0UG0U.exe
\??\o:\	S0UG0U.exe
\??\w:\	S0UG0U.exe
\??\z:\	S0UG0U.exe
\??\g:\	S0UG0U.exe
\??\h:\	S0UG0U.exe
\??\n:\	S0UG0U.exe
\??\p:\	S0UG0U.exe
\??\q:\	S0UG0U.exe
\??\r:\	S0UG0U.exe
\??\t:\	S0UG0U.exe
\??\v:\	S0UG0U.exe
\??\f:\	S0UG0U.exe
\??\j:\	S0UG0U.exe
\??\l:\	S0UG0U.exe
\??\u:\	S0UG0U.exe
\??\x:\	S0UG0U.exe
\??\y:\	S0UG0U.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5532-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/files/0x000900000001b302-2.dat	upx
behavioral2/memory/5532-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4752-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4752-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
236	cmd.exe
4284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywsl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S0UG0U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 4752	5532	jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywsl.exe	89
PID 5532 wrote to memory of 236	5532	jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywsl.exe	90
PID 4752 wrote to memory of 4284	4752	S0UG0U.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywsl.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywsl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Users\Admin\AppData\Local\Temp\S0UG0U.exe
  C:\Users\Admin\AppData\Local\Temp\S0UG0U.exe arg2
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gameupdate.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gameupdate.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gameupdate.bat

Path C:\Users\Admin\AppData\Local\Temp\Gameupdate.bat
Size 151B
SHA256 2335ff1b9f935070ea7d57a267ec87a7269673c16e8551ec745afafb9bed26f8
MD5 0c868490208e3557d51b93d55feba643
SHA1 291b2565763664acf8f3d6488283abf8d769fc07
SHA512 e3e9108d6bf873c4a6c2847e326399f2f21a436055117ed1d8e8d3a0585b6a7a7647f607c1e5963f18101090d909dedffcdbacecd364a38af0f0e99cc1495455
TLSH
T17BC08C05409B8E6D4880A9FB466D20CCE02628AA2B482B010B31804822C2C0CA1E6A01
MD5 SHA1 SHA512 TLSH

Submit Download

Gameupdate.bat

Path C:\Users\Admin\AppData\Local\Temp\Gameupdate.bat
Size 245B
SHA256 f2f584ecf67bda1828b7a83b4c19c36214d0287c2141f250486cc9cd55785b9c
MD5 fb440bd3f465828fc6b3e0279d7ea0f1
SHA1 c23f0d2a2e237b606403374d39ff6264a85e2e57
SHA512 08b8e713b62cf8141a2e20ee8c575b79fcdbe35ddc8ad36bab7476a6dc0b7799b02795c780d0f8015e2632e86b249e7378b6e6a94b071e53f153cbc0e32b7b36
TLSH
T1D8D0A74401855D1B5880DCBB127C5A8E64721A6E3B883F340F32C18B967246BBD92B18
MD5 SHA1 SHA512 TLSH

Submit Download

S0UG0U.exe

Path C:\Users\Admin\AppData\Local\Temp\S0UG0U.exe
Size 38KB
SHA256 ebc01b26c5831bb276037cc2b0c02c2c2429fa8cdabda90da34b37fd7e9b8f84
MD5 11680fd4153728748aec59635ce8ae64
SHA1 def650c8396679ca36e867433f605df8b2c0d562
SHA512 5c4b9a1f0dfa8997ddb45f572790b5fd0ff04b474f7dda9ef3636794f3f01789873a0a1f2654776ca2bd2950faedff17d091d8e3d80753c063b4500ecc2384a5
SSDEEP 768:2+m/j/+FywJHOTMtU01nJa2I/fREJ8daUFCcSmEmYJ/pbBQ7Bo++W:2lOTR1nMT5EezFJPK/ptAKHW
TLSH
T1AE03F1A3EA36A825C93C527D52EFD2B173DD6E9487BEC3431B597839201D5E52C0A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4752-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-22-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5532-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5532-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads