| File name: | ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe |
| Full analysis: | https://app.any.run/tasks/705ddbce-adea-4b58-be14-79610b66faed |
| Verdict: | Malicious activity |
| Analysis date: | August 12, 2024, 03:30:28 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 49ECE4FBF7871DD71A110F63D50B610F |
| SHA1: | E231B2B71013F2162E6A00B2FC8124620C4599E5 |
| SHA256: | 5FC980F6FF110DAE9465213F196C91360EFE7C4EECA7431EE984E4D8F1A9CA70 |
| SSDEEP: | 98304:SJQjo0l7n2ygmR46higoL5gplnzceVbXn5vPStdFu1fPW0kR8WuTaMn/sUaTSDFF:OFogtLCPepDgXC+TMu |
MALICIOUS
No malicious indicators.SUSPICIOUS
Drops the executable file immediately after the start
- ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe (PID: 7016)
- VersionService.exe (PID: 6124)
Executable content was dropped or overwritten
- ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe (PID: 7016)
- VersionService.exe (PID: 6124)
Process drops legitimate windows executable
- VersionService.exe (PID: 6124)
The process drops C-runtime libraries
- VersionService.exe (PID: 6124)
The process creates files with name similar to system file names
- VersionService.exe (PID: 6124)
INFO
Creates files or folders in the user directory
- ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe (PID: 7016)
- ArenaBreakoutInfiniteMiniloader.exe (PID: 7104)
- VersionService.exe (PID: 6124)
Create files in a temporary directory
- ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe (PID: 7016)
Checks supported languages
- ArenaBreakoutInfiniteMiniloader.exe (PID: 7104)
- ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe (PID: 7016)
- VersionService.exe (PID: 6124)
Reads the computer name
- ArenaBreakoutInfiniteMiniloader.exe (PID: 7104)
- VersionService.exe (PID: 6124)
Reads the machine GUID from the registry
- ArenaBreakoutInfiniteMiniloader.exe (PID: 7104)
- VersionService.exe (PID: 6124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:07:02 02:11:15+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 28672 |
| InitializedDataSize: | 150528 |
| UninitializedDataSize: | 2048 |
| EntryPoint: | 0x3ac9 |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.6.235 |
| ProductVersionNumber: | 0.0.6.235 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Windows, Chinese (Simplified) |
| Comments: | - |
| CompanyName: | PROXIMA BETA PTE. LIMITED |
| FileDescription: | - |
| FileVersion: | 0.0.6.235 |
| LegalCopyright: | - |
| LegalTrademarks: | - |
| ProductName: | ArenaBreakoutInfiniteMiniloader |
| ProductVersion: | 0.0.6.235 |
Total processes
134
Monitored processes
5
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6124 | session=1 | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\tiny_dl\VersionService.exe | ArenaBreakoutInfiniteMiniloader.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
| 6216 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | VersionService.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6892 | "C:\Users\admin\AppData\Local\Temp\ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe" | C:\Users\admin\AppData\Local\Temp\ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | — | explorer.exe | |||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: MEDIUM Exit code: 3221226540 Version: 0.0.6.235 Modules
| |||||||||||||||
| 7016 | "C:\Users\admin\AppData\Local\Temp\ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe" | C:\Users\admin\AppData\Local\Temp\ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | explorer.exe | ||||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: HIGH Version: 0.0.6.235 Modules
| |||||||||||||||
| 7104 | "C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\ArenaBreakoutInfiniteMiniloader.exe" | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\ArenaBreakoutInfiniteMiniloader.exe | ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Arena Breakout Infinite Minidown.exe Version: 0.0.6.269 Modules
| |||||||||||||||
Total events
4 185
Read events
4 185
Write events
0
Delete events
0
Modification events
Executable files
122
Suspicious files
89
Text files
350
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7016 | ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\ArenaBreakoutInfiniteMiniloader.exe | executable | |
MD5:706B80B8134015BAAA09358BC30EF93D | SHA256:361439BC1FD72AB8032E71034708C83AE833819FF31AC6F18CF20F970418ED9C | |||
| 7016 | ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\bugreport.ini | text | |
MD5:27EC1E105337C0AD4BDDB8F2A9551F6C | SHA256:ED60CA6895464814F9E5BC132F41645630CC785FAE9FC7DA6362B5690B3A97CD | |||
| 7016 | ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\res.zip | compressed | |
MD5:7A48AA18DF6F224EE1AAF571704C379F | SHA256:AE6BE48320A3A951C0235657FB9EF04A80FDD49ABA926818ABA497B261218AE4 | |||
| 7016 | ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\tiny_dl\VersionServiceProxy.dll | executable | |
MD5:52225CC14CF7EDF42743A94C79CAB83C | SHA256:69585960C69F26C942CC14E5A49A7C9208C86C5E612AF35F9DC4E99149CAE5E3 | |||
| 7104 | ArenaBreakoutInfiniteMiniloader.exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\Local.xml | xml | |
MD5:A6619BCB25F8D87E384689967797A176 | SHA256:10ACEE66F9297D9BF3242473F54FE7362B34D078BFF67A5870216954E4C1AD03 | |||
| 7016 | ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\install_script.dat | binary | |
MD5:371B8AA322670F3DB28995DAE3D58D7E | SHA256:D7130E4C76E1EFFFB6D60F083E5A241BD9CA454B1227E92A876FAA65B50C05E4 | |||
| 6124 | VersionService.exe | C:\Arena Breakout Infinite\launcher\.tiny_cache\Game_7000020.local-journal | binary | |
MD5:8EB4E461A13218BD88CC911938C3898E | SHA256:3B27008CCA9A569BEB3A8811CEA908C742C3F25AA6A24C57D66F5EABDEBCBE1B | |||
| 7016 | ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\Minidown.xml | binary | |
MD5:02453A098EFE8F973162B9E9784285DF | SHA256:4F4DB2CFB491BB621510B167E51EBD3CB2E8CD104FF6DE3BA107DA4E82536E5D | |||
| 7016 | ArenaBreakoutInfiniteMiniloader0.0.6.235(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\icon.ico | image | |
MD5:2F8CEFFB30839715D67FB63279258FC6 | SHA256:72138A9F79E0CDC9D48D6EE2C340AD2A209D64B879BAF0863DDDB18E3E3BE0BE | |||
| 7104 | ArenaBreakoutInfiniteMiniloader.exe | C:\Users\admin\AppData\Roaming\Tencent\TenioDL\Common.ini | text | |
MD5:F21DC1B25E7AA05556DA801F2338E273 | SHA256:1BD9B69DBFB51F81942CDBAAF115308996F73899674DC9C74D42583F1BCE59EE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
59
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6584 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
6636 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
5796 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2424 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 40.126.32.138:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5336 | SearchApp.exe | 104.126.37.130:443 | www.bing.com | Akamai International B.V. | DE | unknown |
4324 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.bing.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
th.bing.com |
| whitelisted |
sg.jupiterlauncher.com |
| unknown |
na.fleetlogd.com |
| unknown |
fd.api.iris.microsoft.com |
| whitelisted |
Threats
Process | Message |
|---|---|
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |