CondoGameMaker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CondoGameMaker.exe
Size 4.3MB
Sample261107-17ffnsvygx
SHA256 c8608be3f3bcad1f9b1152172568a555026d0cb05ee295ec6accb28fc28b6e77
MD5 8285d2cbb1cacc425ed12a9e76083e9a
SHA1 41c7bc1893b6e487b4c3c418a497266de9c72cad
SHA512 1fe1f950b768aee2c0d0530e07121cb0a0f9e9e0116d93d8d24f4388c6a1a708d47fe695b990406a557e1fe44991335fb8bce1795a6ffd78376ae3afe8a6623c
SSDEEP 49152:LGcSgyoByIg3rf44gnUPdrexezFfk4u6gsVMnYfHS6gFupbUe1x5BDhNpYSx7xPZ:+t4UMUVgsVMnY9OiRNp3BkQY+TR
TLSH
T12E266C03E6A580FDC06AC174835AE733FA71BC898435B66B5BD0DB212F69F50AB1E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CondoGameMaker.exe

File Explorer

CondoGameMaker.exe

.exe 4.3MB

CondoGameMaker.exe

IMPHASH ad66908726f65f35cb7734e9c814163e
SHA256 c8608be3f3bcad1f9b1152172568a555026d0cb05ee295ec6accb28fc28b6e77
MD5 8285d2cbb1cacc425ed12a9e76083e9a
SHA1 41c7bc1893b6e487b4c3c418a497266de9c72cad
SHA512 1fe1f950b768aee2c0d0530e07121cb0a0f9e9e0116d93d8d24f4388c6a1a708d47fe695b990406a557e1fe44991335fb8bce1795a6ffd78376ae3afe8a6623c
SSDEEP 49152:LGcSgyoByIg3rf44gnUPdrexezFfk4u6gsVMnYfHS6gFupbUe1x5BDhNpYSx7xPZ:+t4UMUVgsVMnY9OiRNp3BkQY+TR
TLSH
T12E266C03E6A580FDC06AC174835AE733FA71BC898435B66B5BD0DB212F69F50AB1E714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryValueExW SystemFunction036 AdjustTokenPrivileges CopySid GetLengthSid GetTokenInformation IsValidSid LookupPrivilegeValueW OpenProcessToken

kernel32

AddVectoredExceptionHandler Beep CompareStringOrdinal ContinueDebugEvent CreateFileMappingA CreateFileMappingW CreateToolhelp32Snapshot DebugActiveProcess DebugActiveProcessStop DebugSetProcessKillOnExit DeleteCriticalSection EnterCriticalSection FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetProcessHeap GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetThreadContext GetTickCount GetTickCount64 GetVersion GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryW MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency ReadProcessMemory SetThreadContext SetUnhandledExceptionFilter SystemTimeToFileTime Thread32First Thread32Next TryEnterCriticalSection UnmapViewOfFile VirtualAllocEx VirtualFreeEx VirtualQueryEx WaitForDebugEvent WideCharToMultiByte WriteProcessMemory lstrlenW GetModuleHandleA GetProcAddress AreFileApisANSI CancelIo CloseHandle CopyFileExW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileW CreateIoCompletionPort CreateMutexW CreatePipe CreateProcessW CreateRemoteThread CreateThread CreateWaitableTimerExW DeleteFileA DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetOverlappedResult GetProcessId GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStdHandle GetSystemTimes GetTempPathA GetTempPathW GetVolumeInformationW GlobalFree InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList IsThreadAFiber LocalFree LockFile LockFileEx MoveFileExW OpenProcess OpenThread PeekNamedPipe PostQueuedCompletionStatus ReadFile ReadFileEx ResumeThread SetEndOfFile SetEvent SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadPriority SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SuspendThread SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnlockFileEx UpdateProcThreadAttribute WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WriteConsoleW WriteFile WriteFileEx RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtCreateNamedPipeFile NtQueryInformationProcess NtQuerySystemInformation RtlCaptureContext RtlGetVersion RtlLookupFunctionEntry RtlVirtualUnwind NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData

dwmapi

DwmGetWindowAttribute

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject GetDIBits PatBlt SelectObject

iphlpapi

GetExtendedTcpTable

mf

MFEnumDeviceSources

mfplat

MFCreateAttributes MFCreateMediaType MFCreateMemoryBuffer MFCreateSample MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

msimg32

AlphaBlend

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

oleaut32

GetErrorInfo SysFreeString SysStringLen

powrprof

CallNtPowerInformation SetSuspendState

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

user32

BlockInput CallNextHookEx ChangeDisplaySettingsExW CloseClipboard CloseDesktop CloseWindowStation CreateDesktopW DrawIcon DrawIconEx EmptyClipboard EnumDesktopWindows EnumDisplayMonitors EnumDisplaySettingsW EnumWindows ExitWindowsEx FindWindowW GetAsyncKeyState GetClipboardData GetCursorPos GetDC GetForegroundWindow GetGUIThreadInfo GetKeyboardState GetLastInputInfo GetMessageW GetMonitorInfoW GetSystemMetrics GetTopWindow GetWindow GetWindowDC GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IsClipboardFormatAvailable IsIconic IsWindow IsWindowVisible LoadCursorW LoadIconW LockWorkStation MapVirtualKeyW MessageBoxW OpenClipboard OpenDesktopW OpenWindowStationW PostMessageW PostThreadMessageW PrintWindow ReleaseDC SendInput SendMessageW SetClipboardData SetCursorPos SetProcessDpiAwarenessContext SetProcessWindowStation SetThreadDesktop SetWindowsHookExW ShowWindow SystemParametersInfoW ToUnicodeEx UnhookWindowsHookEx WindowFromPoint

winmm

mciSendStringW timeBeginPeriod timeEndPeriod

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getsockopt ioctlsocket recv recvfrom send sendto setsockopt shutdown

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fpreset _initterm _localtime64 _onexit abort calloc exit floor fprintf free fwrite log malloc memchr memcmp memcpy memmove memset pow qsort realloc signal strchr strcmp strcspn strlen strncmp strrchr strspn vfprintf wcslen

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

672KB

Virtual Size

672KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

253KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CondoGameMaker.exe

advapi32

kernel32

ntdll

api-ms-win-shcore-scaling-l1-1-1

bcrypt

crypt32

dwmapi

gdi32

iphlpapi

mf

mfplat

mfreadwrite

msimg32

ole32

oleaut32

powrprof

psapi

shell32

user32

winmm

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

msvcrt

generic