Overview
overview
10Static
static
3Netflix To...er.exe
windows10-2004-x64
8Netflix To...er.exe
windows10-2004-x64
7Netflix To...ys.exe
windows10-2004-x64
8Netflix To...ER.exe
windows10-2004-x64
7Netflix To...er.exe
windows10-2004-x64
7Netflix To...rv.exe
windows10-2004-x64
1Netflix To...v2.exe
windows10-2004-x64
7Netflix To...er.exe
windows10-2004-x64
7Netflix To...ck.exe
windows10-2004-x64
1Netflix To...er.exe
windows10-2004-x64
1Netflix To...ky.exe
windows10-2004-x64
7Netflix To...er.exe
windows10-2004-x64
7Netflix To...db.exe
windows10-2004-x64
1Netflix To...ka.exe
windows10-2004-x64
10Netflix To...er.exe
windows10-2004-x64
7Netflix To...cs.exe
windows10-2004-x64
10Netflix To...V3.exe
windows10-2004-x64
10Netflix To...er.exe
windows10-2004-x64
7Netflix To....0.exe
windows10-2004-x64
10Netflix To...ct.exe
windows10-2004-x64
1Netflix To...ix.exe
windows10-2004-x64
7Netflix To...er.exe
windows10-2004-x64
7Netflix To...ar.exe
windows10-2004-x64
7Netflix To...er.exe
windows10-2004-x64
7Netflix To...ar.exe
windows10-2004-x64
1Netflix To...ui.exe
windows10-2004-x64
1Netflix To...GC.exe
windows10-2004-x64
4Netflix To...er.exe
windows10-2004-x64
7Netflix To...to.exe
windows10-2004-x64
7Netflix To...on.exe
windows10-2004-x64
7Netflix To...er.exe
windows10-2004-x64
7Netflix To...ft.exe
windows10-2004-x64
1Analysis
-
max time kernel
34s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2023 22:56
Static task
static1
Behavioral task
behavioral1
Sample
Netflix Tools PACK/Netflix Tools PACK/GoldFlix GC Netflix Checker/GoldFlix Checker.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral2
Sample
Netflix Tools PACK/Netflix Tools PACK/GoldFlix GC Netflix Checker/core/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral3
Sample
Netflix Tools PACK/Netflix Tools PACK/GoldFlix GC Netflix Checker/core/gfsys.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral4
Sample
Netflix Tools PACK/Netflix Tools PACK/HITFLIX CHECKER/HITFLIX CHECKER.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral5
Sample
Netflix Tools PACK/Netflix Tools PACK/HITFLIX CHECKER/sys/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral6
Sample
Netflix Tools PACK/Netflix Tools PACK/HITFLIX CHECKER/sys/serv.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral7
Sample
Netflix Tools PACK/Netflix Tools PACK/NetFlix Checker by xRisky v2/NetFlix Checker by xRisky v2.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral8
Sample
Netflix Tools PACK/Netflix Tools PACK/NetFlix Checker by xRisky v2/debug/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral9
Sample
Netflix Tools PACK/Netflix Tools PACK/NetFlix Checker by xRisky v2/debug/NetCheck.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral10
Sample
Netflix Tools PACK/Netflix Tools PACK/NetFlix Checker by xRisky v2/debug/chromedriver.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral11
Sample
Netflix Tools PACK/Netflix Tools PACK/NetFlix GC Checker by xRisky/NetFlix GC Checker by xRisky.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral12
Sample
Netflix Tools PACK/Netflix Tools PACK/NetFlix GC Checker by xRisky/data/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral13
Sample
Netflix Tools PACK/Netflix Tools PACK/NetFlix GC Checker by xRisky/data/litedb.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral14
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker by GOD Cracked By GM`ka/Netflix by GOD Cracked By GM`ka.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral15
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker by GOD Cracked By GM`ka/xNet/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral16
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker by GOD Cracked By GM`ka/xNet/procs.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral17
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker Shitter By Team-Otimus V3.0/NetFlix_Shitter_V3.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral18
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker Shitter By Team-Otimus V3.0/Team-Otimus V3.0/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral19
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker Shitter By Team-Otimus V3.0/Team-Otimus V3.0/Shitter 3.0.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral20
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker Shitter By Team-Otimus V3.0/Team-Otimus V3.0/ttdinject.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral21
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker V3.1 by Cetrix/Netflix Checker V3.1 by Centrix.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral22
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker V3.1 by Cetrix/sysdll/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral23
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker v1 by Sh4lltear/Netflix Checker v1 by Sh4lltear.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral24
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker v1 by Sh4lltear/sysdll/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral25
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker v1 by Sh4lltear/sysdll/Sh4lltear.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral26
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker v1 by Sh4lltear/sysdll/wscadminui.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral27
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix GC Generator By SpaceXVIII/Gen/GC.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral28
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix GC Generator By SpaceXVIII/Gen/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral29
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix GC Generator By SpaceXVIII/Netflix GC Cracked.to.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral30
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix password changer + capture by RubiconT/Netflix by Rubicon.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral31
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix password changer + capture by RubiconT/nsi/Launcher.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral32
Sample
Netflix Tools PACK/Netflix Tools PACK/Netflix password changer + capture by RubiconT/nsi/RubiconSoft.exe
Resource
win10v2004-20230621-en
General
-
Target
Netflix Tools PACK/Netflix Tools PACK/Netflix Checker v1 by Sh4lltear/Netflix Checker v1 by Sh4lltear.exe
-
Size
436KB
-
MD5
b029aba0478c2e4952b8d8d47a8254c2
-
SHA1
768a49d63fb3276d5084acafacb51c920c84c06f
-
SHA256
d507efaba5a96790221f25aadbe81d1a26ef94019b39cb7584ff54e06d6b8b68
-
SHA512
e1c09cf6c9fd854cf830fdcaf8828332e357dbd66dd3498ab16aa0b6c8a532bde3c3c9a1b1ba35b9096a66f2a9a0b9cfa8f158fcd4c0c25f2a53aca6a1c024d8
-
SSDEEP
3072:e4lJ7LQ666C66G666i666o666y666B66c666G66f666+666u6669p666366o6663:e6J7gXtwJ3xjpfVKWMy
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Control Panel\International\Geo\Nation Netflix Checker v1 by Sh4lltear.exe Key value queried \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Control Panel\International\Geo\Nation Windows Services.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk Launcher.exe -
Executes dropped EXE 3 IoCs
pid Process 4728 Windows Services.exe 4916 Secure System Shell.exe 3780 Runtime Explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe" Launcher.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\IMF\LICENCE.dat Launcher.exe File opened for modification C:\Windows\IMF\Runtime Explorer.exe Launcher.exe File created C:\Windows\IMF\Secure System Shell.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Secure System Shell.exe Launcher.exe File created C:\Windows\IMF\Windows Services.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Windows Services.exe Launcher.exe File created C:\Windows\IMF\LICENCE.zip Launcher.exe File created C:\Windows\IMF\Runtime Explorer.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\LICENCE.zip Launcher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1448 Launcher.exe 1564 powershell.exe 1564 powershell.exe 4728 Windows Services.exe 4728 Windows Services.exe 4728 Windows Services.exe 4728 Windows Services.exe 4916 Secure System Shell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1448 Launcher.exe Token: SeDebugPrivilege 1564 powershell.exe Token: SeDebugPrivilege 4728 Windows Services.exe Token: SeDebugPrivilege 4916 Secure System Shell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3780 Runtime Explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4756 wrote to memory of 1448 4756 Netflix Checker v1 by Sh4lltear.exe 80 PID 4756 wrote to memory of 1448 4756 Netflix Checker v1 by Sh4lltear.exe 80 PID 4756 wrote to memory of 1448 4756 Netflix Checker v1 by Sh4lltear.exe 80 PID 4756 wrote to memory of 1728 4756 Netflix Checker v1 by Sh4lltear.exe 81 PID 4756 wrote to memory of 1728 4756 Netflix Checker v1 by Sh4lltear.exe 81 PID 4756 wrote to memory of 1728 4756 Netflix Checker v1 by Sh4lltear.exe 81 PID 1448 wrote to memory of 1564 1448 Launcher.exe 82 PID 1448 wrote to memory of 1564 1448 Launcher.exe 82 PID 1448 wrote to memory of 1564 1448 Launcher.exe 82 PID 1448 wrote to memory of 4728 1448 Launcher.exe 84 PID 1448 wrote to memory of 4728 1448 Launcher.exe 84 PID 1448 wrote to memory of 4728 1448 Launcher.exe 84 PID 4728 wrote to memory of 4916 4728 Windows Services.exe 85 PID 4728 wrote to memory of 4916 4728 Windows Services.exe 85 PID 4728 wrote to memory of 4916 4728 Windows Services.exe 85 PID 4728 wrote to memory of 3780 4728 Windows Services.exe 86 PID 4728 wrote to memory of 3780 4728 Windows Services.exe 86 PID 4728 wrote to memory of 3780 4728 Windows Services.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix Checker v1 by Sh4lltear\Netflix Checker v1 by Sh4lltear.exe"C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix Checker v1 by Sh4lltear\Netflix Checker v1 by Sh4lltear.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix Checker v1 by Sh4lltear\sysdll\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix Checker v1 by Sh4lltear\sysdll\Launcher.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Windows\IMF\Windows Services.exe"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\IMF\Secure System Shell.exe"C:\Windows\IMF\Secure System Shell.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3780
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix Checker v1 by Sh4lltear\sysdll\Sh4lltear.exe"C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix Checker v1 by Sh4lltear\sysdll\Sh4lltear.exe"2⤵PID:1728
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
144KB
MD5ec70c6f4dc443c5ab2b91d64ae04fa8e
SHA143eb3b3289782fced204f0b4e3edad2ba1b085b7
SHA256276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d
SHA5126217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584
-
Filesize
144KB
MD5ec70c6f4dc443c5ab2b91d64ae04fa8e
SHA143eb3b3289782fced204f0b4e3edad2ba1b085b7
SHA256276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d
SHA5126217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584
-
Filesize
144KB
MD5ec70c6f4dc443c5ab2b91d64ae04fa8e
SHA143eb3b3289782fced204f0b4e3edad2ba1b085b7
SHA256276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d
SHA5126217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584
-
Filesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
Filesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
Filesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
Filesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53
-
Filesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53
-
Filesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53