21d332cd235e8d9e97571ae208ffa899018a024cd47a8e5a3c526f1e3a278436

Sharing

Copy URL Twitter E-mail

General

Target
Pizza-Tower-SteamRIP.com.rar
Size 601.4MB
Sample261107-tk9yfad14q
SHA256 21d332cd235e8d9e97571ae208ffa899018a024cd47a8e5a3c526f1e3a278436
MD5 2a4e5141154684b4d5e3429e4a064783
SHA1 4ad4640a5dac33b11b6e76fd5f8e672ec6be72b5
SHA512 5041c593673f5a895f5f26bf68db0a0e6fc23d9b07698b26b141f939edaf51b60cc6fb4f01f407191f4e53885bfadd8b605d95ed7b90ab109475717a1136674c
SSDEEP 12582912:jnS/aV+G3viYSnqaBWtuDokT2qSQlRqnnH/C03z80CdU9+rs0PUeZ:jnSmiYSnFcADoq2/nfC03z8m9+rjUeZ
TLSH
T1F569338F1E97B1B45B066E12007AFC2F6E1E8B30706B5087CDBE1A9769715CA49C8F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Pizza Tower/PizzaTower.exe
- Size 6.7MB
- SHA256 4a07c50ec0c659d24d25e19b12ee111d289462ca0e64dd34a7c7f13d2e6c9f1d
- MD5 b2d54e6e34f87f6baabb6df4308190d0
- SHA1 9caf5db51307f9c4d7b67350b2b5ba5c825ff19d
- SHA512 bd8e88d00b76375ec5e67e0fa22f9464d25c9158fe92528d5deac82fd9b339d5ccc8df4607ae2f4801250d0286519da01172b9bbefb1748efd6ce51428d95895
- SSDEEP 196608:91J0RvrxpiA76rXI565kqgy+lHX/TlD5qqutk5ZcPErh6W:8++lPyELuHW
- TLSH
  T12A66598636A5C1ADD127803CC5569AFAE2713C45CF5097CB2AA07F6D3F33AD40ABB611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Pizza Tower/Steamworks_x64.dll
- Size 443KB
- SHA256 3a348a05e245b232d7c90a7674402b374e924dc975bc3d267800fcbc5e70d18d
- MD5 04121386d3c6e139c159450ba9ad3a8c
- SHA1 96f989f63808cb6e61d4900d31ff5cfe873bd340
- SHA512 8b2da2a5cbca60b518ac619154034265942899bdfbbf47641457bf68d0f63111eb782861bd5220df91b0e485921172ee71794ac95e4d2e4a3a5c29f10445146b
- SSDEEP 6144:OmZuQ9/zeq6Y93Y1EvyBgqn+YePRUz357/69el7vs0ohMcX9TRA0PwKW:OuNY1EvyBP+YERUbV68j3oOcX9n
- TLSH
  T175A46C0AF3A410A2D167E178CD639947E6B3784A0392D7DF13A4926E2F77BD0293E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Pizza Tower/fmod-gamemaker.dll
- Size 35KB
- SHA256 0cbb76f9bd8987c194b891c3c0b14c3ffb15ae0f676623a811090ca7619bd3b3
- MD5 7d03df224eef39d3c507e33fe2165158
- SHA1 c8a1f626079a3a7e750d5205d1ed92f3f9d6c499
- SHA512 2dd05d7495456cda7bbea293032569ea6956b22f9e96e2a68de291bb3cc54e5240471d3994a04ff3481f4d76ded694803e55a870490a8aa8ba806a82d596ab54
- SSDEEP 384:HshbIB/FimHZgyn1bMVB39LkS7XuTE8L8RMO3VH6cbJ/NlGz8WDf9qGuokHmbPIz:4+S1/NlGz8W7bIOPOP4I7
- TLSH
  T104F23A57679500F5C9F3B03D87171E47D122B6A18761A3EF0370025A2F33AEA2EBD54A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Pizza Tower/fmod.dll
- Size 1.8MB
- SHA256 e78d09eafe87c4699e23e7b1fa88d99e4d031538c452d8647e3961bc104dbe09
- MD5 bf5815e7bbcbe5d2d5cb84900527536f
- SHA1 b6f4c2e0d57a17c0096d287679f855e2a3f68f6a
- SHA512 7933df1990b9cddd2f50737e8980c7fdbf572586cd74a76a9f9e2f2e35b26a3bae9e0f66d45d5d9fdd400de29274cf042ff98e84a3c6441b919281f6d7cfaed4
- SSDEEP 24576:JVcCsfgfaDCHWnfFbHZmIHqizddHiVAZZVbNhUTPiRIVPaoF4iVzwI6n:JVcCsYfd2dbAaBdr3WYQP1F46c
- TLSH
  T12E85BE85B1F584EDE027D13C912BBB2BF672308407206ADF47E045A96FA3BD16B7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Pizza Tower/fmodstudio.dll
- Size 1.4MB
- SHA256 489e8d08b760579a1974de3865a16c9c5e6dd989a09c831cf1c8c7db7c1ea50f
- MD5 3aa316d24bac9601e3136d73cee0193d
- SHA1 9448c6c683239b9b67a73831112a8a2d3e077541
- SHA512 e2f2093665b40b2aa705e6e92cd93a823361928e8d527d40cb42f4d548b6dfba72d0aa05b4046225ec2a00fe84b25f0c5cf41af091a2355c41a119dc08c30d8c
- SSDEEP 24576:WDdspg+MtYUteTzXmYs8NGo4mmHq30JbV/ybI:2sp5MtYgeTzXm4/7+T/yM
- TLSH
  T13E658C4B22B410D8DA67E23CD6176B1BE6F274551720EBEF16B446E95B03BE6633E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Pizza Tower/gameframe_x64.dll
- Size 6KB
- SHA256 bf6699ee52f7e52dc2444de4afece133a37127d194272e323509120497b7d974
- MD5 d2503d70b9ada6302b9424caf6987522
- SHA1 ba327c52f3ab987b1218f8cda363c4003e6b4db6
- SHA512 fa40bc000aab587b0642863016eab43bd67331e9653fd4f5e4a8863ed284e362c01866b7deecf6ad7f05acdc6b741bab8ac9f83a0f4ddc6ad8ddcc5c19e18a04
- SSDEEP 96:GosrIC4lrlf+4JWuPUMLcIS9JF+Y+MIUnKnM:GL74FAeBjcbYo
- TLSH
  T197D1939BA7D494F6E03743F88CB3171A2528B0F0675207DF4E0505DA1522BCA223F721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Pizza Tower/steam_api64.dll
- Size 416KB
- SHA256 51425709b07d703f2b675828520c8d38af2d014f40d175695bc299c32b37f685
- MD5 163cbe0ac6df4199bc273b7416903ce4
- SHA1 13830bea2d1ff683fa9c5c0a8b30966b5f18f450
- SHA512 c0d89ea1176d244827c4851b06321c60ef15f76ba9925ee53b8cbabdefbde08bc1e13f6bca0273518ef44d824c5ec8663f2d080b240a7096eccb4553853b1364
- SSDEEP 12288:TwftwkcPj/wghq1GNasjw7jLFTP2116HtsywfCpr:8l8j/1hq16nAd2f66ywfCpr
- TLSH
  T12194E03B701615F8D6BAD134AA556E0FBAA4008F31652CFE36108533C89BA572F776CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Pizza Tower/steam_api64.rne
- Size 291KB
- SHA256 1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3
- MD5 6b4ab6e60364c55f18a56a39021b74a6
- SHA1 39cac2889d8ca497ee0d8434fc9f6966f18fa336
- SHA512 c08de8c6e331d13dfe868ab340e41552fc49123a9f782a5a63b95795d5d979e68b5a6ab171153978679c0791dc3e3809c883471a05864041ce60b240ccdd4c21
- SSDEEP 3072:504VEQ2u/niy9UVLCe9ZqdrP+VXvv+sJYB2RHKBi65lhTbCc+hnvvEyP7yq+uei1:QZu/i874ZcrMv2cRh7yqO2CPLHxYq8/B
- TLSH
  T1AB54487AA2710CF4E076C13A88565E0FF671744B63219EFF226053369E576C21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 219B
- SHA256 4572f3812daf7bcd347d1a36834c5a9fec1f530093adf688a6ecd9e6092cbf76
- MD5 bb3af69a2e7704bc210886920ff7681f
- SHA1 42fa4a09d62cce1c0d70a63e0816135fd6b410e3
- SHA512 4f86d06f06859ed87d5f5353de9971c118477c956a8e0e0019b275f6eb035b2841c7cb959c9f4823a599ca7e73f6a0ed320207d917e8f4ab2a9b20e732551839
- TLSH
  T119D0A9BA0B58900AD321C81AE030BC08E44E75568CDED0B932C4CA8A4D96481C8A6BA8
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion
- Uses Rundll32 to proxy-execute a payload
  Rundll32 is a signed Windows utility that executes code inside DLLs. It can load specific system libraries to run malicious executables or scripts.
  defense_evasion
behavioral17 behavioral18
- Target
  _CommonRedist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  _CommonRedist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral23 behavioral24
- Target
  _CommonRedist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  _CommonRedist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  _CommonRedist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral29 behavioral30
- Target
  _CommonRedist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Uses Rundll32 to proxy-execute a payload

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Checks installed software on the system

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32