Overview
overview
10Static
static
10Luxury Shi...UI.dll
windows7-x64
1Luxury Shi...UI.dll
windows10-2004-x64
1Luxury Shi...I2.dll
windows7-x64
1Luxury Shi...I2.dll
windows10-2004-x64
1Luxury Shi...ge.exe
windows7-x64
1Luxury Shi...ge.exe
windows10-2004-x64
1Luxury Shi...np.exe
windows7-x64
10Luxury Shi...np.exe
windows10-2004-x64
10Luxury Shi...ld.exe
windows7-x64
7Luxury Shi...ld.exe
windows10-2004-x64
7Luxury Shi...on.dll
windows7-x64
1Luxury Shi...on.dll
windows10-2004-x64
1Luxury Shi...on.dll
windows7-x64
1Luxury Shi...on.dll
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2023 00:35
Behavioral task
behavioral1
Sample
Luxury Shield/Guna.UI.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Luxury Shield/Guna.UI.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Luxury Shield/Guna.UI2.dll
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
Luxury Shield/Guna.UI2.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Luxury Shield/ILMerge.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Luxury Shield/ILMerge.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Luxury Shield/Infected.pnggnp.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
Luxury Shield/Infected.pnggnp.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Luxury Shield/Luxury Shield.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
Luxury Shield/Luxury Shield.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
Luxury Shield/Newtonsoft.Json.dll
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
Luxury Shield/Newtonsoft.Json.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
Luxury Shield/System.Web.Optimization.dll
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
Luxury Shield/System.Web.Optimization.dll
Resource
win10v2004-20230703-en
General
-
Target
Luxury Shield/Infected.pnggnp.exe
-
Size
63KB
-
MD5
cdc128617b3fa5492f6a4fce1576427e
-
SHA1
42c96d2bf2b90f61df7003670e17553fe78897ac
-
SHA256
21cdcbfeaa08ca6645098af1b3739de9699ad7d54700348915d91c31c04ad171
-
SHA512
642b2589cd4092331d3e84fab22e1b961abd3d5a0a86d7af734edd73d1adb357a5baebeefda04092c7d56207e62b034a93ca8c902e9386c07b03cf13890cbe9b
-
SSDEEP
1536:WmNvVdSJYUbdh98ifu+pbSfucdpqKmY7:WkVYYUbdoCu8bSGz
Malware Config
Extracted
asyncrat
Default
Kaught-36793.portmap.host:1194
Kaught-36793.portmap.host:53088
Kaught-53088.portmap.host:1194
Kaught-53088.portmap.host:53088
MTjPNΓת1勒ih德h吉kg3Oשwc
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral8/memory/4600-133-0x0000000000C50000-0x0000000000C66000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Infected.pnggnp.exedescription pid process Token: SeDebugPrivilege 4600 Infected.pnggnp.exe