← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
3poundmel
WHITE ELLELEVLEN11 2022-05-18 Modified: 2022-06-17
1495
IOCs
HIGH VOLUME
trojanmemoryfile scandropped fileokay resizingokay sdkunicodeerrorpathriot clientnullcriticalsuspiciousdelphibindunknownenterpriseexecutorriotrestlocallockfilefebruaryclickencryptfaillaunchermediamaliciousteam
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (6 / 1495 total)
All URL domain hostname email FileHash-SHA256 CVE FileHash-MD5 FileHash-SHA1 SSLCertFingerprint IPv4
TYPEINDICATORDESCRIPTIONCREATED
email hostmaster@riotgames.com — 2022-05-18
email ftp@example.com — 2022-05-18
email domain-admin@newrelic.com — 2022-05-18
email appro@openssl.org — 2022-05-18
email abuse@rebel.com — 2022-05-18
email abusecomplaints@markmonitor.com — 2022-05-18
References (6)
↗ VALORANT.exe ↗ 162.247.243.148 ↗ Queries firmware table information (may be used to fingerprint/evade) details "RiotClientServices.exe" at 00000000-00003384-00000033-3266853 "RiotClientServices.exe" at 00000000-00003384-00000033-3267044 "RiotClientServices.exe" at 00000000-00003400-00000033-3764888 "RiotClientServices.exe" at 00000000-00003400-00000033-3765111 "RiotClientServices.exe" at 00000000-00002172-00000033-13613833225596776 "RiotClientServices.exe" at 00000000-00002172-00000033-13613833225597548 "RiotClientServices.exe" at 00000000 ↗ #Firmware ↗ https://hybrid-analysis.com/sample/c16e4bccd6961c074ec0f43d37727061e494d7647f5953c89107c98fc42a2d04/62161ffe897ab2603a7a39e9 ↗ helped by someone else's hybrid scan thank you