analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

dynamicgame__dy.exe

Full analysis: https://app.any.run/tasks/ec2b18bb-f415-4024-b101-16e79c46b4ee
Verdict: Malicious activity
Analysis date: December 28, 2021, 21:09:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

73895FD8DC9385C7DE2F6F6D6ECE6CAF

SHA1:

FFF889EF92550A55341281FFB8BED76DB6CD4C1F

SHA256:

BB813D7A7FD6D578F39FD8420FAD5504912365E3A798D490F653EB832248B481

SSDEEP:

98304:K43bzphwnzYZe41Y1x0o9I6k6p5zbdMMR9xtlU+swpk:KPnzYZe6Y1x0o9IRwzKqHsw+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • dynamicgame__dy.exe (PID: 2212)
      • havtool.exe (PID: 3184)
      • sysinfo-app.exe (PID: 1212)

    • Drops executable file immediately after starts

      • dynamicgame__dy.exe (PID: 3752)

    • Connects to CnC server

      • dynamicgame__dy.exe (PID: 3752)
      • dynamicgame__dy.exe (PID: 2212)

    • Loads dropped or rewritten executable

      • dynamicgame__dy.exe (PID: 2212)

  • SUSPICIOUS

    • Reads the computer name

      • dynamicgame__dy.exe (PID: 3752)
      • dynamicgame__dy.exe (PID: 2212)
      • havtool.exe (PID: 3184)

    • Checks supported languages

      • dynamicgame__dy.exe (PID: 3752)
      • cmd.exe (PID: 3324)
      • sysinfo-app.exe (PID: 1212)
      • dynamicgame__dy.exe (PID: 2212)
      • havtool.exe (PID: 3184)

    • Drops a file with a compile date too recent

      • dynamicgame__dy.exe (PID: 3752)

    • Drops a file with too old compile date

      • dynamicgame__dy.exe (PID: 3752)

    • Executable content was dropped or overwritten

      • dynamicgame__dy.exe (PID: 3752)

    • Drops a file that was compiled in debug mode

      • dynamicgame__dy.exe (PID: 3752)

    • Starts CMD.EXE for commands execution

      • dynamicgame__dy.exe (PID: 2212)

    • Reads Environment values

      • dynamicgame__dy.exe (PID: 2212)

  • INFO

    • Reads settings of System Certificates

      • dynamicgame__dy.exe (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:06:16 10:58:42+02:00
PEType: PE32
LinkerVersion: 14.16
CodeSize: 950784
InitializedDataSize: 3343872
UninitializedDataSize: -
EntryPoint: 0x9b2f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.3.11.0
ProductVersionNumber: 3.3.11.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 3.3.11.0
InternalName: Playstoreinstaller-flow5mkt.exe
LegalCopyright: GamesLOL
LegalTrademarks: -
OriginalFileName: Playstoreinstaller-flow5mkt.exe
ProductName: -
ProductVersion: 3.3.11.0
AssemblyVersion: 3.3.11.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Jun-2020 08:58:42
Detected languages:
  • English - United States
  • Russian - Russia
Debug artifacts:
  • C:\BuildAgent\work\70e04e42d8888b\Release\Extractor.pdb
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 3.3.11.0
InternalName: Playstoreinstaller-flow5mkt.exe
LegalCopyright: GamesLOL
LegalTrademarks: -
OriginalFilename: Playstoreinstaller-flow5mkt.exe
ProductName: -
ProductVersion: 3.3.11.0
Assembly Version: 3.3.11.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 16-Jun-2020 08:58:42
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000E81B9
0x000E8200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.54572
.rdata
0x000EA000
0x0003C5B0
0x0003C600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.88179
.data
0x00127000
0x000090AC
0x00007200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.93789
.rsrc
0x00131000
0x002DC359
0x002DC400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.98828
.reloc
0x0040E000
0x0000E8C8
0x0000EA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.56195

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST
2
5.01327
4264
UNKNOWN
English - United States
RT_ICON
3
4.57138
9640
UNKNOWN
English - United States
RT_ICON
4
4.36872
16936
UNKNOWN
English - United States
RT_ICON
9
3.29735
276
UNKNOWN
English - United States
RT_STRING
132
7.99826
2704025
UNKNOWN
Russian - Russia
RT_RCDATA
133
7.82997
150786
UNKNOWN
English - United States
RT_RCDATA
134
7.82383
110096
UNKNOWN
English - United States
RT_RCDATA
IDI_EXTRACTOR
2.62308
62
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
IPHLPAPI.DLL
KERNEL32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
WININET.dll
WS2_32.dll
gdiplus.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
5
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start dynamicgame__dy.exe dynamicgame__dy.exe cmd.exe no specs sysinfo-app.exe no specs havtool.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3752"C:\Users\admin\AppData\Local\Temp\dynamicgame__dy.exe" C:\Users\admin\AppData\Local\Temp\dynamicgame__dy.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Version:
3.3.11.0
Modules
Images
c:\users\admin\appdata\local\temp\dynamicgame__dy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2212"C:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\dynamicgame__dy.exe" --localAppDataPath="C:\Users\admin\AppData\Local\MobiGame\\"C:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\dynamicgame__dy.exe
dynamicgame__dy.exe
User:
admin
Integrity Level:
HIGH
Version:
3.3.11.0
Modules
Images
c:\users\admin\appdata\local\temp\mobigame_f8b93cb5\dynamicgame__dy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3324"cmd.exe" /c "utils\sysinfo-app.exe"C:\Windows\system32\cmd.exe—dynamicgame__dy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\cmd.exe
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1212utils\sysinfo-app.exeC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\utils\sysinfo-app.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\mobigame_f8b93cb5\utils\sysinfo-app.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\opengl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3184"C:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\utils\havdetectiontool\sources\i386\havtool.exe" /qC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\utils\havdetectiontool\sources\i386\havtool.exe—dynamicgame__dy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Hardware Assisted Virtualization Detection Tool
Exit code:
1
Version:
6.1.7600.16471 (win7_gdr_oob_havtool(wmbla).090930-1630)
Modules
Images
c:\users\admin\appdata\local\temp\mobigame_f8b93cb5\utils\havdetectiontool\sources\i386\havtool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
4 378
Read events
4 332
Write events
46
Delete events
0

Modification events

(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3752) dynamicgame__dy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionReason
Value:
1
Executable files
18
Suspicious files
0
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\MobiGame\hwid.dattext
MD5:98A6209DFD509EFD85002F2363283475
SHA256:C7051CBC8C6923F20918730B8A2BFFA27F3E6EE1AB807AA45E3CA8A49D6F6D05
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\MobiGame\installid.dattext
MD5:A53BC273B593A3286F19CB96AE796244
SHA256:9DE28F18FAAC2D18E30F23EF95BAB49D191419169500B05E5A85671981784DC2
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\Interop.Shell32.dllexecutable
MD5:861A558EC22B1FE5284B47BDE9F77FC2
SHA256:A5369077907F1122FCF46EF854E39C17CC1CFC2EA217465FB3F4935DA5789CE5
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\Playstoreinstaller-flow5mkt.exeexecutable
MD5:BED9E2D473E1A6162AF056BC12A7A7AC
SHA256:D29EBE0D7052C3917F6450FCF905C7EA8236063666A212BF1784589D237241AC
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\Interop.IWshRuntimeLibrary.dllexecutable
MD5:86B309C77138667F12DE51CF0DB2A7BA
SHA256:0F04BFF1A93E076A5C63E20555F8AD56A41B1F3F17C3990772E8051CB9670BFA
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\utils\x86\Pin2Taskbar.exeexecutable
MD5:613610CBFE43FD5044BD7C34C835BC2B
SHA256:FCA54E1765CF93A8C068C0AA2F37D20AFA654AC679BA886A2DDF95835681BADA
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\Extractor.exeexecutable
MD5:A77B3C1A8B0D555289AA06345C9D862C
SHA256:9A589D11A9A67799C3D0814C88034AFB1DA4792E6D5E8F83FCE5BBCDA8C411F2
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\utils\x64\Pin2Taskbar.exeexecutable
MD5:5DA83330A44E10230695E95F52C9E664
SHA256:9A6E9047E32EDB62287B5AE07C25C6595F14C19CCA34B508C13E89D7C941097C
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\log4net.dllexecutable
MD5:7C11F28D40F846515C132C5E358913BB
SHA256:8CDAE744CB81A397C61F9311E1BD089206783B8B173D6E8216005B84662FDA1E
3752dynamicgame__dy.exeC:\Users\admin\AppData\Local\Temp\MobiGame_F8B93CB5\utils\sysinfo-app.exeexecutable
MD5:65E9505C4F651CF03C6D34E8FA99D48B
SHA256:6B1666F705DA241DC83AD755FF44E5DA29C7BC9324883A6EA85F89C484B80C46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
19
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2212
dynamicgame__dy.exe
GET
204
54.157.110.1:80
http://stats.emu.codes/action?hwid=9C10BB71DD7C4094A5C3416B21F9253A&macAddress=12A9866C77DE&ipAddressLocal=192.168.100.185&sourceUrl=&installDate=2021-12-28T21%3A10%3A14.199Z&platform=Windows&version=3.3.11.0&virtualization=&status=22&instId=49212DED23964F38A40F460F64BB39AC&emulatorType=vbox&apkPackageName=&googleAnalyticsId=
US
—
—
suspicious
3752
dynamicgame__dy.exe
POST
204
54.157.110.1:80
http://stats.emu.codes/action
US
—
—
suspicious
3752
dynamicgame__dy.exe
POST
200
52.27.132.196:80
http://logs-01.loggly.com/bulk/5b54b21f-6ef0-4fe1-818d-d834760d845a/tag/mobigame
US
binary
19 b
whitelisted
3752
dynamicgame__dy.exe
POST
204
54.157.110.1:80
http://stats.emu.codes/action
US
—
—
suspicious
3752
dynamicgame__dy.exe
POST
—
54.175.252.46:80
http://logs-01.loggly.com/bulk/5b54b21f-6ef0-4fe1-818d-d834760d845a/tag/mobigame
US
—
—
whitelisted
3752
dynamicgame__dy.exe
POST
200
54.175.252.46:80
http://logs-01.loggly.com/bulk/5b54b21f-6ef0-4fe1-818d-d834760d845a/tag/mobigame,extractor,status
US
binary
19 b
whitelisted
3752
dynamicgame__dy.exe
POST
200
54.175.252.46:80
http://logs-01.loggly.com/bulk/5b54b21f-6ef0-4fe1-818d-d834760d845a/tag/mobigame
US
binary
19 b
whitelisted
3752
dynamicgame__dy.exe
POST
204
54.157.110.1:80
http://stats.emu.codes/action
US
—
—
suspicious
3752
dynamicgame__dy.exe
POST
204
54.157.110.1:80
http://stats.emu.codes/action
US
—
—
suspicious
3752
dynamicgame__dy.exe
POST
200
54.175.252.46:80
http://logs-01.loggly.com/bulk/5b54b21f-6ef0-4fe1-818d-d834760d845a/tag/mobigame
US
binary
19 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3752
dynamicgame__dy.exe
52.27.132.196:80
logs-01.loggly.com
Amazon.com, Inc.
US
unknown
—
—
52.27.132.196:443
logs-01.loggly.com
Amazon.com, Inc.
US
unknown
3752
dynamicgame__dy.exe
54.157.110.1:80
stats.emu.codes
Amazon.com, Inc.
US
malicious
2212
dynamicgame__dy.exe
143.204.98.100:443
mbdl219.com
—
US
suspicious
3752
dynamicgame__dy.exe
54.175.252.46:80
logs-01.loggly.com
Amazon.com, Inc.
US
unknown
3752
dynamicgame__dy.exe
54.152.104.18:80
logs-01.loggly.com
Amazon.com, Inc.
US
suspicious
2212
dynamicgame__dy.exe
54.157.110.1:80
stats.emu.codes
Amazon.com, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
logs-01.loggly.com
  • 54.175.252.46
  • 52.27.132.196
  • 54.152.104.18
whitelisted
stats.emu.codes
  • 54.157.110.1
suspicious
mbdl219.com
  • 143.204.98.100
  • 143.204.98.52
  • 143.204.98.11
  • 143.204.98.5
shared

Threats

PID
Process
Class
Message
3752
dynamicgame__dy.exe
A Network Trojan was detected
ET MALWARE Win32/MobiGame Install Stats Checkin M1
3752
dynamicgame__dy.exe
A Network Trojan was detected
ET MALWARE Win32/MobiGame Install Stats Checkin M1
3752
dynamicgame__dy.exe
A Network Trojan was detected
ET MALWARE Win32/MobiGame Install Stats Checkin M1
3752
dynamicgame__dy.exe
A Network Trojan was detected
ET MALWARE Win32/MobiGame Install Stats Checkin M1
3752
dynamicgame__dy.exe
A Network Trojan was detected
ET MALWARE Win32/MobiGame Install Stats Checkin M1
2212
dynamicgame__dy.exe
A Network Trojan was detected
ET MALWARE Win32/MobiGame Install Stats Checkin M2
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
dynamicgame__dy.exe