Overview
overview
10Static
static
3Loader.rar
windows11-21h2-x64
3Loader/Loader.rar
windows11-21h2-x64
3Loader/Ant...sabler
windows11-21h2-x64
1Loader/Gam...Inject
windows11-21h2-x64
1Loader/Gam...meMenu
windows11-21h2-x64
1Loader/Gam...Status
windows11-21h2-x64
1Loader/GameDetect
windows11-21h2-x64
1Loader/Launcher.dll
windows11-21h2-x64
1Loader/Loader.exe
windows11-21h2-x64
10Loader/Upd...pdater
windows11-21h2-x64
1Loader/Upd...eb.xml
windows11-21h2-x64
1Loader/config
windows11-21h2-x64
1Loader/mainf.dll
windows11-21h2-x64
1Loader/mco...ig.xml
windows11-21h2-x64
1Loader/Password.txt
windows11-21h2-x64
3Analysis
-
max time kernel
212s -
max time network
274s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-06-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
Loader.rar
Resource
win11-20240611-en
Behavioral task
behavioral2
Sample
Loader/Loader.rar
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
Loader/AntiCheatDisabler
Resource
win11-20240611-en
Behavioral task
behavioral4
Sample
Loader/GameCheck/GameInject
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Loader/GameCheck/GameMenu
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
Loader/GameCheck/GameStatus
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
Loader/GameDetect
Resource
win11-20240611-en
Behavioral task
behavioral8
Sample
Loader/Launcher.dll
Resource
win11-20240611-en
Behavioral task
behavioral9
Sample
Loader/Loader.exe
Resource
win11-20240611-en
Behavioral task
behavioral10
Sample
Loader/Updater/Updater
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
Loader/Updater/web.xml
Resource
win11-20240611-en
Behavioral task
behavioral12
Sample
Loader/config
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
Loader/mainf.dll
Resource
win11-20240611-en
Behavioral task
behavioral14
Sample
Loader/mconfig/config.xml
Resource
win11-20240419-en
Behavioral task
behavioral15
Sample
Loader/Password.txt
Resource
win11-20240508-en
General
-
Target
Loader/mconfig/config.xml
-
Size
25KB
-
MD5
f34b330f20dce1bdcce9058fca287099
-
SHA1
936520d5bb5c00a1985d7a4c4f0ef763a9031862
-
SHA256
0c56e34c69124510fa8c19e7b4c2ca6c1c4ff460ae19f798dd0ca035809e396d
-
SHA512
d6d4a8321eb44c117755a41a2590296be86a0568d27a5347f9d7f32f2d151d8f7e169675c83faed2dab5ad0f8d81858f8cd1167e439cd4bff7e68c243e3544fd
-
SSDEEP
192:Bt074zTxASaKp3T7pJsPpPT8B13eeaVonGdEBMmhVbeyeTfWDBzmAwdavahmhNIa:LAMDp35JyPCCu96yJwgag
Malware Config
Signatures
-
Processes:
iexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1631058277" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31115663" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
MSOXMLED.EXEdescription pid process target process PID 5100 wrote to memory of 2256 5100 MSOXMLED.EXE iexplore.exe PID 5100 wrote to memory of 2256 5100 MSOXMLED.EXE iexplore.exe
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Loader\mconfig\config.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Loader\mconfig\config.xml2⤵
- Modifies Internet Explorer settings
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5100-2-0x00007FFEF5250000-0x00007FFEF5260000-memory.dmpFilesize
64KB
-
memory/5100-1-0x00007FFEF5250000-0x00007FFEF5260000-memory.dmpFilesize
64KB
-
memory/5100-0-0x00007FFEF5250000-0x00007FFEF5260000-memory.dmpFilesize
64KB
-
memory/5100-3-0x00007FFEF5250000-0x00007FFEF5260000-memory.dmpFilesize
64KB
-
memory/5100-4-0x00007FFEF5250000-0x00007FFEF5260000-memory.dmpFilesize
64KB
-
memory/5100-5-0x00007FFF35263000-0x00007FFF35264000-memory.dmpFilesize
4KB
-
memory/5100-7-0x00007FFF351C0000-0x00007FFF353C9000-memory.dmpFilesize
2.0MB
-
memory/5100-6-0x00007FFF351C0000-0x00007FFF353C9000-memory.dmpFilesize
2.0MB
-
memory/5100-8-0x00007FFF351C0000-0x00007FFF353C9000-memory.dmpFilesize
2.0MB
-
memory/5100-9-0x00007FFF351C0000-0x00007FFF353C9000-memory.dmpFilesize
2.0MB
-
memory/5100-10-0x00007FFF351C0000-0x00007FFF353C9000-memory.dmpFilesize
2.0MB
-
memory/5100-16-0x00007FFEF5250000-0x00007FFEF5260000-memory.dmpFilesize
64KB
-
memory/5100-17-0x00007FFF351C0000-0x00007FFF353C9000-memory.dmpFilesize
2.0MB
-
memory/5100-15-0x00007FFEF5250000-0x00007FFEF5260000-memory.dmpFilesize
64KB
-
memory/5100-14-0x00007FFEF5250000-0x00007FFEF5260000-memory.dmpFilesize
64KB
-
memory/5100-13-0x00007FFEF5250000-0x00007FFEF5260000-memory.dmpFilesize
64KB
-
memory/5100-12-0x00007FFF351C0000-0x00007FFF353C9000-memory.dmpFilesize
2.0MB
-
memory/5100-11-0x00007FFF351C0000-0x00007FFF353C9000-memory.dmpFilesize
2.0MB