17c7edb74499fc21f81b15475b728c9d3db7f0d61976938e275b8bc7d0c575d9

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.ftm.exe
Size 212KB
Sample261014-lefhmsa16m
SHA256 17c7edb74499fc21f81b15475b728c9d3db7f0d61976938e275b8bc7d0c575d9
MD5 27b0381c80d0263b7751016f3b7dca00
SHA1 928b75e1e71291f82acb0dd3ee69682ac907ad87
SHA512 b9bebaaff20b0297173ce2b976bfe2d1968aed22c13e4220ba06b3c705679a0868bf5e01e627ae4593ccb03ab6bab24c6c0bbad837dfbd32dc58526fc899cda1
SSDEEP 3072:wh2T+7eC8AutTBf4ytriyI/Lbj2S+fuUX3qa5GnfM4ZES9dg:wh2i7eiutTBPibbWuGqa5GEGES9
TLSH
T1AA244BA9D68DC3E3E8B094BA055E4896FFF5D4B106C0A99205ACFC0411D3877772A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
704	fs.exe

Loads dropped DLL 1 IoCs

pid	Process
5064	rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ksuser.dll	fs.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	fs.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	fs.exe
File created	C:\Windows\SysWOW64\midimap.dll	fs.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	fs.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	fs.exe
File created	C:\Windows\SysWOW64\sysapp18.dll	fs.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	fs.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	fs.exe
File created	C:\Windows\SysWOW64\msimg32.dll	fs.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c57b-18.dat	upx
behavioral2/memory/704-20-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/704-29-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4956	sc.exe
3456	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5784	cmd.exe
3908	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-GameThief.Win32.Frethoq.ftm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
704	fs.exe
704	fs.exe
704	fs.exe
704	fs.exe
704	fs.exe
704	fs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
704	fs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 5784	3424	jaffacakes118_Trojan-GameThief.Win32.Frethoq.ftm.exe	89
PID 3424 wrote to memory of 3908	3424	jaffacakes118_Trojan-GameThief.Win32.Frethoq.ftm.exe	91
PID 3908 wrote to memory of 704	3908	cmd.exe	93
PID 704 wrote to memory of 4160	704	fs.exe	94
PID 704 wrote to memory of 3456	704	fs.exe	95
PID 704 wrote to memory of 4956	704	fs.exe	96
PID 704 wrote to memory of 5064	704	fs.exe	99
PID 4160 wrote to memory of 4332	4160	net.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Frethoq.ftm.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Frethoq.ftm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp\Ô×°Íâ¹Ò.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp\fs.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Temp\fs.exe
    "C:\Users\Admin\AppData\Local\Temp\Temp\fs.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\Windows\SysWOW64\net.exe
      net stop cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
  - - C:\Windows\SysWOW64\sc.exe
      sc config cryptsvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3456
  - - C:\Windows\SysWOW64\sc.exe
      sc delete cryptsvc
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4956
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Users\Admin\AppData\Local\Temp\1791969994.dat, ServerMain c:\users\admin\appdata\local\temp\temp\fs.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1791969994.dat

Path C:\Users\Admin\AppData\Local\Temp\1791969994.dat
Size 33KB
SHA256 6dabf40c92aecb5a2249593a6997c7aac8ce7873a42c7a3d92fd9001bc3b9ff1
MD5 da55ce1af9a5a0df20bf6574fbe4fa01
SHA1 5e460c75e46ee803dab1b260a946017b60c3724c
SHA512 71c7ff1e313b8ba12a47fea7937946c020ae35eb37c7ef8a16f5d7a3e39f049dda8295799484190bf33bf3acf9c323c1f9741a9507cb168fa33be475398cfde8
SSDEEP 768:pl5T3NZG8ZWfI9zZHF17ZPXM74oTSqOHiSREI/aV:v5T0oz57ZPXM7bbeRhY
TLSH
T143F26D02BA468863D3DF023075052F7ADBFCA8305A469255EB539B872C759D7EB3A343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fs.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp\fs.exe
Size 33KB
SHA256 dd630f405fbb53a4a1be053e14784b65ae89d7e2ccfd05cbff2565a862b14693
MD5 e1bc7c89f4a149d2295cecad9fbee9d6
SHA1 64ae8e27b69e88f95e6dc405f072f3aa2c5fe138
SHA512 d81333bfb9f8b35f4e4601aa1bac906bc855c61dd26a09f06c9369391781e65c08356fb475a09fb24d8d6938fb0b24699dfe594b7dd0d1a0a834324bb1b50ca8
SSDEEP 768:/eq5YtQ4oXE/MZyY/uNjaCRpmo8Z0IkmcorwC4izqBCcM:/zmC4NL4eaCDBIkBq43Cc
TLSH
T1CDE2E145B76A99CDF22BCB75D3F388116A10BC526A37E6A72F2074143DA40713AC37E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fs.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\Temp\fs.exe.bat
Size 157B
SHA256 8653bf0568ebe6e3b6a4ff4c082719365820e8af5babfbaa88ff21eb5a39d85f
MD5 2c2dc991b3ff9315f313aa39dd5e9a37
SHA1 2e762547061bc5500174cb78b07ca20268709d91
SHA512 a15182cee4b4939a33a84320337f05fe83413345158d1a91c2982a239b44e911c73e4f3f8d9e1b198d5acfd29ccef6c947ff23d45c0e880a8fcb33586409319a
TLSH
T14FC00211C2A78A690C4860571969A54D80ED189C3A852B616E15945D11D181FB6C6721
MD5 SHA1 SHA512 TLSH

Submit Download

Ô×°Íâ¹Ò.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\Temp\Ô×°Íâ¹Ò.exe.bat
Size 175B
SHA256 ca5ea94080cc918a65243677a4d25ffd85030ad1e3594a39cdd9b11592f59562
MD5 c19e2026c4160242e63eeda7170ad81d
SHA1 2c39e3182347b67c31acf91c888edb08f09f9119
SHA512 214537f1efd27f3492c29dcfbf3798764cec657dd8b1c3e44f0b7bb066f7b6b21c30ddf3d24f940b832cc3aaa947845ac13b0300768cfbcb77ddfc40987ae633
TLSH
T131C01221C2BB866A490D712B8569624CC0E92DCC3A452F284E60852A12C194FB6C2301
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-20-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/704-29-0x0000000000400000-0x0000000000416000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads