Overview
overview
3Static
static
3Config/Plu...64.dll
windows7-x64
1Config/Plu...64.dll
windows10-2004-x64
1Config/Plu...64.dll
windows7-x64
1Config/Plu...64.dll
windows10-2004-x64
1Config/Plu...86.dll
windows7-x64
1Config/Plu...86.dll
windows10-2004-x64
1Config/Plu...es.dll
windows7-x64
1Config/Plu...es.dll
windows10-2004-x64
1Config/amd...st.dll
windows7-x64
3Config/amd...st.dll
windows10-2004-x64
3Config/amd...er.dll
windows7-x64
1Config/amd...er.dll
windows10-2004-x64
1Config/amd...ot.exe
windows7-x64
1Config/amd...ot.exe
windows10-2004-x64
1Config/amd...pi.dll
windows7-x64
1Config/amd...pi.dll
windows10-2004-x64
1Config/amd...dk.exe
windows7-x64
Config/amd...dk.exe
windows10-2004-x64
Config/arm...st.dll
windows7-x64
1Config/arm...st.dll
windows10-2004-x64
1Config/arm...er.dll
windows7-x64
1Config/arm...er.dll
windows10-2004-x64
1Config/x86...st.dll
windows7-x64
3Config/x86...st.dll
windows10-2004-x64
3Config/x86...er.dll
windows7-x64
1Config/x86...er.dll
windows10-2004-x64
1Config/x86...ot.exe
windows7-x64
1Config/x86...ot.exe
windows10-2004-x64
1Config/x86...pi.dll
windows7-x64
1Config/x86...pi.dll
windows10-2004-x64
1Config/x86/wofadk.exe
windows7-x64
Config/x86/wofadk.exe
windows10-2004-x64
Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2023 01:32
Static task
static1
Behavioral task
behavioral1
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.amd64.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.amd64.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral3
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.arm64.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.arm64.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral5
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.x86.dll
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.x86.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral7
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/PluginRes.dll
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/PluginRes.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral9
Sample
Config/amd64/CBSHost.dll
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
Config/amd64/CBSHost.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral11
Sample
Config/amd64/NCleaner.dll
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
Config/amd64/NCleaner.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral13
Sample
Config/amd64/bcdboot.exe
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
Config/amd64/bcdboot.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral15
Sample
Config/amd64/wimgapi.dll
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
Config/amd64/wimgapi.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral17
Sample
Config/amd64/wofadk.exe
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
Config/amd64/wofadk.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral19
Sample
Config/arm64/CBSHost.dll
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
Config/arm64/CBSHost.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral21
Sample
Config/arm64/NCleaner.dll
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
Config/arm64/NCleaner.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral23
Sample
Config/x86/CBSHost.dll
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
Config/x86/CBSHost.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral25
Sample
Config/x86/NCleaner.dll
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
Config/x86/NCleaner.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral27
Sample
Config/x86/bcdboot.exe
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
Config/x86/bcdboot.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral29
Sample
Config/x86/wimgapi.dll
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
Config/x86/wimgapi.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral31
Sample
Config/x86/wofadk.exe
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
Config/x86/wofadk.exe
Resource
win10v2004-20230831-en
General
-
Target
Config/x86/CBSHost.dll
-
Size
122KB
-
MD5
9966252f6b62752f38bde0ff2970300d
-
SHA1
4c02d8470093db823f371bfc023d44ab80ad4970
-
SHA256
059f28e9b517b9345a30e409f1e7eecaab2d643a180dfa8fb1d105cac137cbb2
-
SHA512
f1c198b1e9b52fe8b96fbed9312328e73f4f5d989f72686b61b13abed9676fdd352e07bf4a48ed767ab6a38830489133f7cc217791a425fbf79c6b4a2c9cd82c
-
SSDEEP
3072:mbBSJBuX3y7IyNulaMf9GOGFSKvGFdof8HGOoK3kj:mbMuX3blaMf+aJvoK3
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2220 4364 WerFault.exe 85 -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeSecurityPrivilege 4364 rundll32.exe Token: 35 4364 rundll32.exe Token: SeLoadDriverPrivilege 4364 rundll32.exe Token: SeBackupPrivilege 4364 rundll32.exe Token: SeRestorePrivilege 4364 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4256 wrote to memory of 4364 4256 rundll32.exe 85 PID 4256 wrote to memory of 4364 4256 rundll32.exe 85 PID 4256 wrote to memory of 4364 4256 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\x86\CBSHost.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\x86\CBSHost.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 6283⤵
- Program crash
PID:2220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4364 -ip 43641⤵PID:1880