Overview
overview
10Static
static
10AnyDesk v3...V).exe
windows10-2004-x64
1DLL Explor...32.exe
windows10-2004-x64
7DLL Explor...64.exe
windows10-2004-x64
7DLL UnInje...or.exe
windows10-2004-x64
1Everything...ng.exe
windows10-2004-x64
7Everything...up.exe
windows10-2004-x64
4LastActivi...ew.exe
windows10-2004-x64
9LastActivi...ew.bat
windows10-2004-x64
9Lastproverka.bat
windows10-2004-x64
3NirCMD 2.8...md.exe
windows10-2004-x64
9NirCMD 2.8...xe.bat
windows10-2004-x64
9NirCMD 2.8...xe.bat
windows10-2004-x64
9OpenedFile...32.exe
windows10-2004-x64
9OpenedFile...64.exe
windows10-2004-x64
8Process Hacker 2.lnk
windows10-2004-x64
3Recuva 1.5...le.exe
windows10-2004-x64
7Shellbag_a...er.exe
windows10-2004-x64
10USBDeview ...ew.exe
windows10-2004-x64
9UserAssist...ew.exe
windows10-2004-x64
9processhac...up.exe
windows10-2004-x64
7Resubmissions
19-10-2023 11:09
231019-m9hf6agh68 10Analysis
-
max time kernel
430s -
max time network
443s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-ja -
resource tags
arch:x64arch:x86image:win10v2004-20230915-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
19-10-2023 11:09
Behavioral task
behavioral1
Sample
AnyDesk v3.6.3 (аналог TV).exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral2
Sample
DLL Explorer 1.2/DLLExplorer32.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral3
Sample
DLL Explorer 1.2/DLLExplorer64.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral4
Sample
DLL UnInjector 1.3/NVTDLLUnInjector.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral5
Sample
Everything 1.4.1.877/Everything.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral6
Sample
Everything-1.4.1.1022.x86-Setup.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral7
Sample
LastActivityView 1.2.7/LastActivityView.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral8
Sample
LastActivityView 1.2.7/Сохранить отчет LastActivityView.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral9
Sample
Lastproverka.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral10
Sample
NirCMD 2.8.1/nircmd.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral11
Sample
NirCMD 2.8.1/Скриншот hl2.exe.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral12
Sample
NirCMD 2.8.1/Скриншот ucp.exe.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral13
Sample
OpenedFilesView 1.80/OpenedFilesView_32.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral14
Sample
OpenedFilesView 1.80/OpenedFilesView_64.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral15
Sample
Process Hacker 2.lnk
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral16
Sample
Recuva 1.53.1087 Pro & Portable/Recuva_Portable.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral17
Sample
Shellbag_analyzer_cleaner.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral18
Sample
USBDeview 2.73/USBDeview.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral19
Sample
UserAssistView 1.0.2/UserAssistView.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral20
Sample
processhacker-2.39-setup.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
General
-
Target
NirCMD 2.8.1/Скриншот hl2.exe.bat
-
Size
941B
-
MD5
d27cfeabdff3e1dfda4d57473e4b8f0a
-
SHA1
a9104297d2f43e9165ed0aa30c08c0278ae45052
-
SHA256
5445407d7ef11995daba416811c2c973a31e57fee778f40a3903199a0675b9cb
-
SHA512
23f040f038e1854f21b9ee0ea0fa74edf2d096ecf4906be6d308e1017dd7d1bae30797f35b1a0b10da2d22bdc7a08022f5cf39c822600249cbc661e5905f5830
Malware Config
Signatures
-
Nirsoft 3 IoCs
resource yara_rule behavioral11/memory/2640-1-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/4488-4-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/4612-14-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
resource yara_rule behavioral11/memory/2640-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral11/memory/2640-1-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral11/memory/4488-4-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral11/memory/4612-14-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral11/memory/4336-20-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 2640 4480 cmd.exe 84 PID 4480 wrote to memory of 2640 4480 cmd.exe 84 PID 4480 wrote to memory of 2640 4480 cmd.exe 84 PID 4480 wrote to memory of 3172 4480 cmd.exe 85 PID 4480 wrote to memory of 3172 4480 cmd.exe 85 PID 4480 wrote to memory of 3172 4480 cmd.exe 85 PID 4480 wrote to memory of 1872 4480 cmd.exe 86 PID 4480 wrote to memory of 1872 4480 cmd.exe 86 PID 4480 wrote to memory of 1872 4480 cmd.exe 86 PID 4480 wrote to memory of 4488 4480 cmd.exe 87 PID 4480 wrote to memory of 4488 4480 cmd.exe 87 PID 4480 wrote to memory of 4488 4480 cmd.exe 87 PID 4480 wrote to memory of 3712 4480 cmd.exe 88 PID 4480 wrote to memory of 3712 4480 cmd.exe 88 PID 4480 wrote to memory of 3712 4480 cmd.exe 88 PID 4480 wrote to memory of 3736 4480 cmd.exe 89 PID 4480 wrote to memory of 3736 4480 cmd.exe 89 PID 4480 wrote to memory of 3736 4480 cmd.exe 89 PID 4480 wrote to memory of 3020 4480 cmd.exe 90 PID 4480 wrote to memory of 3020 4480 cmd.exe 90 PID 4480 wrote to memory of 3020 4480 cmd.exe 90 PID 4480 wrote to memory of 1752 4480 cmd.exe 92 PID 4480 wrote to memory of 1752 4480 cmd.exe 92 PID 4480 wrote to memory of 1752 4480 cmd.exe 92 PID 4480 wrote to memory of 4316 4480 cmd.exe 93 PID 4480 wrote to memory of 4316 4480 cmd.exe 93 PID 4480 wrote to memory of 4316 4480 cmd.exe 93 PID 4480 wrote to memory of 1692 4480 cmd.exe 94 PID 4480 wrote to memory of 1692 4480 cmd.exe 94 PID 4480 wrote to memory of 1692 4480 cmd.exe 94 PID 4480 wrote to memory of 2844 4480 cmd.exe 95 PID 4480 wrote to memory of 2844 4480 cmd.exe 95 PID 4480 wrote to memory of 2844 4480 cmd.exe 95 PID 4480 wrote to memory of 3948 4480 cmd.exe 96 PID 4480 wrote to memory of 3948 4480 cmd.exe 96 PID 4480 wrote to memory of 3948 4480 cmd.exe 96 PID 4480 wrote to memory of 4612 4480 cmd.exe 97 PID 4480 wrote to memory of 4612 4480 cmd.exe 97 PID 4480 wrote to memory of 4612 4480 cmd.exe 97 PID 4480 wrote to memory of 3728 4480 cmd.exe 100 PID 4480 wrote to memory of 3728 4480 cmd.exe 100 PID 4480 wrote to memory of 3728 4480 cmd.exe 100 PID 4480 wrote to memory of 4396 4480 cmd.exe 103 PID 4480 wrote to memory of 4396 4480 cmd.exe 103 PID 4480 wrote to memory of 4396 4480 cmd.exe 103 PID 4480 wrote to memory of 4128 4480 cmd.exe 104 PID 4480 wrote to memory of 4128 4480 cmd.exe 104 PID 4480 wrote to memory of 4128 4480 cmd.exe 104 PID 4480 wrote to memory of 4504 4480 cmd.exe 105 PID 4480 wrote to memory of 4504 4480 cmd.exe 105 PID 4480 wrote to memory of 4504 4480 cmd.exe 105 PID 4480 wrote to memory of 1596 4480 cmd.exe 106 PID 4480 wrote to memory of 1596 4480 cmd.exe 106 PID 4480 wrote to memory of 1596 4480 cmd.exe 106 PID 4480 wrote to memory of 4336 4480 cmd.exe 107 PID 4480 wrote to memory of 4336 4480 cmd.exe 107 PID 4480 wrote to memory of 4336 4480 cmd.exe 107 PID 4480 wrote to memory of 3192 4480 cmd.exe 108 PID 4480 wrote to memory of 3192 4480 cmd.exe 108 PID 4480 wrote to memory of 3192 4480 cmd.exe 108 PID 4480 wrote to memory of 4004 4480 cmd.exe 109 PID 4480 wrote to memory of 4004 4480 cmd.exe 109 PID 4480 wrote to memory of 4004 4480 cmd.exe 109 PID 4480 wrote to memory of 2776 4480 cmd.exe 110
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\Скриншот hl2.exe.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe win activate title "Counter-Strike Source"2⤵PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe win settopmost title "Counter-Strike Source" 12⤵PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe wait 252⤵PID:1872
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey alt down2⤵PID:4488
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey tab down2⤵PID:3712
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey alt up2⤵PID:3736
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey tab up2⤵PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe wait 252⤵PID:1752
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey alt down2⤵PID:4316
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey tab down2⤵PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey alt up2⤵PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey tab up2⤵PID:3948
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe monitor off2⤵PID:4612
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe beep 5000 20002⤵PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey delete press2⤵PID:4396
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey insert press2⤵PID:4128
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe wait 102⤵PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe monitor off2⤵PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe savescreenshot "SMIJWJMH#Admin_CSS_Screenshot.jpg"2⤵PID:4336
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe wait 102⤵PID:3192
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey insert press2⤵PID:4004
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe monitor on2⤵PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe win min title "Counter-Strike Source"2⤵PID:3480
-