Overview
overview
10Static
static
10AnyDesk v3...V).exe
windows10-2004-x64
1DLL Explor...32.exe
windows10-2004-x64
7DLL Explor...64.exe
windows10-2004-x64
7DLL UnInje...or.exe
windows10-2004-x64
1Everything...ng.exe
windows10-2004-x64
7Everything...up.exe
windows10-2004-x64
4LastActivi...ew.exe
windows10-2004-x64
9LastActivi...ew.bat
windows10-2004-x64
9Lastproverka.bat
windows10-2004-x64
3NirCMD 2.8...md.exe
windows10-2004-x64
9NirCMD 2.8...xe.bat
windows10-2004-x64
9NirCMD 2.8...xe.bat
windows10-2004-x64
9OpenedFile...32.exe
windows10-2004-x64
9OpenedFile...64.exe
windows10-2004-x64
8Process Hacker 2.lnk
windows10-2004-x64
3Recuva 1.5...le.exe
windows10-2004-x64
7Shellbag_a...er.exe
windows10-2004-x64
10USBDeview ...ew.exe
windows10-2004-x64
9UserAssist...ew.exe
windows10-2004-x64
9processhac...up.exe
windows10-2004-x64
7Resubmissions
19-10-2023 11:09
231019-m9hf6agh68 10Analysis
-
max time kernel
401s -
max time network
417s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-ja -
resource tags
arch:x64arch:x86image:win10v2004-20230915-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
19-10-2023 11:09
Behavioral task
behavioral1
Sample
AnyDesk v3.6.3 (аналог TV).exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral2
Sample
DLL Explorer 1.2/DLLExplorer32.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral3
Sample
DLL Explorer 1.2/DLLExplorer64.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral4
Sample
DLL UnInjector 1.3/NVTDLLUnInjector.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral5
Sample
Everything 1.4.1.877/Everything.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral6
Sample
Everything-1.4.1.1022.x86-Setup.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral7
Sample
LastActivityView 1.2.7/LastActivityView.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral8
Sample
LastActivityView 1.2.7/Сохранить отчет LastActivityView.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral9
Sample
Lastproverka.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral10
Sample
NirCMD 2.8.1/nircmd.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral11
Sample
NirCMD 2.8.1/Скриншот hl2.exe.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral12
Sample
NirCMD 2.8.1/Скриншот ucp.exe.bat
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral13
Sample
OpenedFilesView 1.80/OpenedFilesView_32.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral14
Sample
OpenedFilesView 1.80/OpenedFilesView_64.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral15
Sample
Process Hacker 2.lnk
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral16
Sample
Recuva 1.53.1087 Pro & Portable/Recuva_Portable.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral17
Sample
Shellbag_analyzer_cleaner.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral18
Sample
USBDeview 2.73/USBDeview.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral19
Sample
UserAssistView 1.0.2/UserAssistView.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
Behavioral task
behavioral20
Sample
processhacker-2.39-setup.exe
Resource
win10v2004-20230915-ja
windows10-2004-x64
General
-
Target
NirCMD 2.8.1/Скриншот ucp.exe.bat
-
Size
945B
-
MD5
1da47c1fa8903e1af2cbea2190f32b7a
-
SHA1
eeb9ad2dac3697bd92b38398ab0c7c320456bb41
-
SHA256
62ef08bf3ff8ad148db0167cb0c301b154b540e5bd794e01c74d70649dbcc2b2
-
SHA512
69a0249b0b7f07b4e5178f4f883bccee76ab992310a8dbb98b7168f5d27f0876c7c95c1421e622cd43be61a9438baf8ea60ca9e8e21abe68a6e18c44c197e73c
Malware Config
Signatures
-
Nirsoft 2 IoCs
resource yara_rule behavioral12/memory/3144-1-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral12/memory/2812-13-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
resource yara_rule behavioral12/memory/3144-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral12/memory/3144-1-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral12/memory/2812-13-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 3144 2408 cmd.exe 84 PID 2408 wrote to memory of 3144 2408 cmd.exe 84 PID 2408 wrote to memory of 3144 2408 cmd.exe 84 PID 2408 wrote to memory of 2084 2408 cmd.exe 85 PID 2408 wrote to memory of 2084 2408 cmd.exe 85 PID 2408 wrote to memory of 2084 2408 cmd.exe 85 PID 2408 wrote to memory of 1564 2408 cmd.exe 86 PID 2408 wrote to memory of 1564 2408 cmd.exe 86 PID 2408 wrote to memory of 1564 2408 cmd.exe 86 PID 2408 wrote to memory of 3624 2408 cmd.exe 87 PID 2408 wrote to memory of 3624 2408 cmd.exe 87 PID 2408 wrote to memory of 3624 2408 cmd.exe 87 PID 2408 wrote to memory of 3804 2408 cmd.exe 88 PID 2408 wrote to memory of 3804 2408 cmd.exe 88 PID 2408 wrote to memory of 3804 2408 cmd.exe 88 PID 2408 wrote to memory of 1420 2408 cmd.exe 90 PID 2408 wrote to memory of 1420 2408 cmd.exe 90 PID 2408 wrote to memory of 1420 2408 cmd.exe 90 PID 2408 wrote to memory of 2988 2408 cmd.exe 91 PID 2408 wrote to memory of 2988 2408 cmd.exe 91 PID 2408 wrote to memory of 2988 2408 cmd.exe 91 PID 2408 wrote to memory of 4188 2408 cmd.exe 92 PID 2408 wrote to memory of 4188 2408 cmd.exe 92 PID 2408 wrote to memory of 4188 2408 cmd.exe 92 PID 2408 wrote to memory of 2488 2408 cmd.exe 93 PID 2408 wrote to memory of 2488 2408 cmd.exe 93 PID 2408 wrote to memory of 2488 2408 cmd.exe 93 PID 2408 wrote to memory of 5108 2408 cmd.exe 94 PID 2408 wrote to memory of 5108 2408 cmd.exe 94 PID 2408 wrote to memory of 5108 2408 cmd.exe 94 PID 2408 wrote to memory of 1964 2408 cmd.exe 95 PID 2408 wrote to memory of 1964 2408 cmd.exe 95 PID 2408 wrote to memory of 1964 2408 cmd.exe 95 PID 2408 wrote to memory of 2532 2408 cmd.exe 96 PID 2408 wrote to memory of 2532 2408 cmd.exe 96 PID 2408 wrote to memory of 2532 2408 cmd.exe 96 PID 2408 wrote to memory of 2812 2408 cmd.exe 97 PID 2408 wrote to memory of 2812 2408 cmd.exe 97 PID 2408 wrote to memory of 2812 2408 cmd.exe 97 PID 2408 wrote to memory of 4800 2408 cmd.exe 98 PID 2408 wrote to memory of 4800 2408 cmd.exe 98 PID 2408 wrote to memory of 4800 2408 cmd.exe 98 PID 2408 wrote to memory of 4816 2408 cmd.exe 100 PID 2408 wrote to memory of 4816 2408 cmd.exe 100 PID 2408 wrote to memory of 4816 2408 cmd.exe 100 PID 2408 wrote to memory of 4672 2408 cmd.exe 101 PID 2408 wrote to memory of 4672 2408 cmd.exe 101 PID 2408 wrote to memory of 4672 2408 cmd.exe 101 PID 2408 wrote to memory of 1676 2408 cmd.exe 102 PID 2408 wrote to memory of 1676 2408 cmd.exe 102 PID 2408 wrote to memory of 1676 2408 cmd.exe 102 PID 2408 wrote to memory of 336 2408 cmd.exe 103 PID 2408 wrote to memory of 336 2408 cmd.exe 103 PID 2408 wrote to memory of 336 2408 cmd.exe 103 PID 2408 wrote to memory of 4168 2408 cmd.exe 104 PID 2408 wrote to memory of 4168 2408 cmd.exe 104 PID 2408 wrote to memory of 4168 2408 cmd.exe 104 PID 2408 wrote to memory of 4196 2408 cmd.exe 105 PID 2408 wrote to memory of 4196 2408 cmd.exe 105 PID 2408 wrote to memory of 4196 2408 cmd.exe 105 PID 2408 wrote to memory of 3668 2408 cmd.exe 106 PID 2408 wrote to memory of 3668 2408 cmd.exe 106 PID 2408 wrote to memory of 3668 2408 cmd.exe 106 PID 2408 wrote to memory of 3712 2408 cmd.exe 107
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\Скриншот ucp.exe.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe win activate title "Counter-Strike Source"2⤵PID:3144
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe win settopmost title "Counter-Strike Source" 12⤵PID:2084
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe wait 252⤵PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey alt down2⤵PID:3624
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey tab down2⤵PID:3804
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey alt up2⤵PID:1420
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey tab up2⤵PID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe wait 252⤵PID:4188
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey alt down2⤵PID:2488
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey tab down2⤵PID:5108
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey alt up2⤵PID:1964
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey tab up2⤵PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe monitor off2⤵PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe beep 5000 20002⤵PID:4800
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey delete press2⤵PID:4816
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey insert press2⤵PID:4672
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe wait 102⤵PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe monitor off2⤵PID:336
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe savescreenshot "BQNDLEKG#Admin_CSS-UCP_Screenshot.jpg"2⤵PID:4168
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe wait 102⤵PID:4196
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe sendkey insert press2⤵PID:3668
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe monitor on2⤵PID:3712
-
-
C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exenircmd.exe win min title "Counter-Strike Source"2⤵PID:1432
-