Unity - True Facials [v0.58b Pro] [HenryTaiwan]

• Two files observed: bin.exe (legitimate Unity executable) and TrueFacials.exe (malicious impersonator).
• Malicious behavior reproduced in a VM: extraction of a .bat into the temporary folder and execution via cmd.exe.
• The malware attempts to download / place updater.exe in a path that impersonates a browser updater (e.g. C:\Program Files (x86)\Google...\updater.exe) and launch it.
• Registry modifications observed targeting persistence and service manipulation:
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run (adds startup entry).
  • HKLM\SYSTEM\CurrentControlSet\Services (modifies/creates service entries).
  • HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE (modified).
  • etc... all files created and accessed can be seen at the following VirusTotal link
• Network activity: connections to numerous external IPs consistent with C2 behavior.
• Spawns additional processes/services and creates multiple .tmp files and batch scripts in %LOCALAPPDATA%\Temp.
• Associated file hashes/parents noted in analysis indicate affiliation with keygens and random archives (IOCs that increase suspicion).
• Earliest seen timestamp in the wild (per the provided analysis): 2021-08-27 13:21:44 UTC indicates this malicious build has been available for years.

• This is not a heuristic alert with no side effects. The binary actively modifies registry keys, creates & executes batch files, spawns processes/services, and downloads/places a payload that impersonates a browser updater. Those are explicit malicious behaviors, not a heuristics mistake.
• Behavior reproducible in an isolated VM.

poopybutt77 said:

DO NOT RUN THIS GAME

UNTIL THE DEVELOPER / OP CAN EXPLAIN THESE DETECTIONS, AND FILE OPERATIONS.



bin.exe

TrueFacials.exe

Both do the same, both have different anti virus results.


The virus one, injects into C:\Program Files (x86)\Google1608_1329478733\bin\updater.exe

View attachment 3764914


Does this really look like something this forum shouldn't look into?

Do I need to manually reverse engineer this executable to prove the developer (OR ORIGINAL POSTER !! ! ) is doing something fishy.

View attachment 3764915

Related parents, aka shared file hashes. Why is it affiliated with keygens, and random zips???

It establishes connections to multiple external IP addresses. These connections are potentially command-and-control (C2) servers, indicating the malware's attempt to communicate with an external source for instructions or data exfiltration.

Spawns new processes and services, indicating the execution of its payload and attempts to maintain control over the infected system.

It modifies registry entries in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run to ensure it runs every time the system starts.

Changes in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services to manipulate system services, often to disable security-related services or to create new malicious services.

Modifies the key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE, potentially to affect browser behavior and user credential handling.

View attachment 3764941 View attachment 3764942

The malware creates numerous .tmp files in the user's temporary directory (AppData\Local\Temp). These files are likely used as intermediate stages in the malware's execution process.

The malware uses cmd.exe to execute batch files (.bat) located in the temporary directory. These batch files are used to execute the primary malicious payload.

The malware masquerades as the Google updater to blend in with legitimate processes. This is indicated by paths like C:\Program Files (x86)\Google\Update\.

By creating and executing multiple batch files, the malware ensures persistence and continuous execution, making it harder to remove.

Click to expand...