Overview

overview

4

Static

static

1

droidkit-en-setup.exe

windows7-x64

4

droidkit-en-setup.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    11s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-10-2023 05:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    droidkit-en-setup.exe

  • Size

    19.5MB

  • MD5

    10b9713adf037d033d31f84d89d32c3d

  • SHA1

    1396c8735135bfd8e96738fa48a3f88e8c45d3c7

  • SHA256

    ae2001d5b60a2f0bd8e72c0106363950cd9f68e9ce42b9a40b0af26814908809

  • SHA512

    9e7fbd6bbc2439b2eda5c5b5ccef8d639f9e9a772e34c05e0f949c28a4cf54eed98aa2fa6d4828fb250a8edd72fbc3ddf4a8f44b2119aa607983d91a1b26e178

  • SSDEEP

    393216:YqrsNeQztKB1QH9MCPIpB6LhMtGiUIsBws6XYbTkrXDTNiDRUGJwPAEWXD:YUibzQoH9MSIMgDYUX3NiDRUGJ2YT

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\droidkit-en-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\droidkit-en-setup.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    PID:1068
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"3F82DB61\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw""
      2⤵
        PID:5008
        • C:\Windows\SysWOW64\curl.exe
          curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"3F82DB61\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw"
          3⤵
            PID:4512

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      System Information Discovery

      2
      T1082

      Query Registry

      1
      T1012

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\CheckProVs.dll
        Filesize

        7KB

        MD5

        62e85098ce43cb3d5c422e49390b7071

        SHA1

        df6722f155ce2a1379eff53a9ad1611ddecbb3bf

        SHA256

        ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2

        SHA512

        dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\CheckProVs.dll
        Filesize

        7KB

        MD5

        62e85098ce43cb3d5c422e49390b7071

        SHA1

        df6722f155ce2a1379eff53a9ad1611ddecbb3bf

        SHA256

        ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2

        SHA512

        dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\GoogleTracingLib.dll
        Filesize

        36KB

        MD5

        d8fca35ff95fe00a7174177181f8bd13

        SHA1

        fbafea4d2790dd2c0d022dfb08ded91de7f5265e

        SHA256

        ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c

        SHA512

        eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\GoogleTracingLib.dll
        Filesize

        36KB

        MD5

        d8fca35ff95fe00a7174177181f8bd13

        SHA1

        fbafea4d2790dd2c0d022dfb08ded91de7f5265e

        SHA256

        ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c

        SHA512

        eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\System.dll
        Filesize

        11KB

        MD5

        ca332bb753b0775d5e806e236ddcec55

        SHA1

        f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

        SHA256

        df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

        SHA512

        2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\System.dll
        Filesize

        11KB

        MD5

        ca332bb753b0775d5e806e236ddcec55

        SHA1

        f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

        SHA256

        df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

        SHA512

        2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\System.dll
        Filesize

        11KB

        MD5

        ca332bb753b0775d5e806e236ddcec55

        SHA1

        f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

        SHA256

        df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

        SHA512

        2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\msvcp100.dll
        Filesize

        593KB

        MD5

        d029339c0f59cf662094eddf8c42b2b5

        SHA1

        a0b6de44255ce7bfade9a5b559dd04f2972bfdc8

        SHA256

        934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c

        SHA512

        021d9af52e68cb7a3b0042d9ed6c9418552ee16df966f9ccedd458567c47d70471cb8851a69d3982d64571369664faeeae3be90e2e88a909005b9cdb73679c82

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\msvcr100.dll
        Filesize

        809KB

        MD5

        366fd6f3a451351b5df2d7c4ecf4c73a

        SHA1

        50db750522b9630757f91b53df377fd4ed4e2d66

        SHA256

        ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5

        SHA512

        2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\msvcr100.dll
        Filesize

        809KB

        MD5

        366fd6f3a451351b5df2d7c4ecf4c73a

        SHA1

        50db750522b9630757f91b53df377fd4ed4e2d66

        SHA256

        ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5

        SHA512

        2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\nsDui.dll
        Filesize

        9.0MB

        MD5

        fc8be2fd5c46a940874644112f603694

        SHA1

        f94aef70e533190fd0c4e7b5fbbcf5457922d3d2

        SHA256

        22f435bd2039f9fed0892c53ec75fb2e675b34eafade9230c2e7b23a5674df08

        SHA512

        b1538dffc40e6321fd1a69e027e37356ac1550f9ea29cd1e44f9144fbfdca8f778656c49d975b49643285155b5ce52dbe88ca42f27bbab3779ee5f636ca94a59

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsh3034.tmp\nsDui.dll
        Filesize

        8.9MB

        MD5

        8930b9e6d7398bd41fcff5c3acbdae7f

        SHA1

        bba0276e9df2e89ee586bac22e67829a3afe8b69

        SHA256

        0903ec370b7d49202f166e3633fed9b1fa9488fdc2d600ded95c9cfaa48d9e2a

        SHA512

        3f3c78d099ba8a43d34e48dbc9e9963995a0bfa26561781942e62ceb9c21ff14ba93909b5e4d5f42dd425ba06eefdbcea4a94a20e5d1ae2632e6524c662a2cc4

        Download Submit