Overview
overview
6Static
static
6P990Root/A...pi.dll
windows7-x64
3P990Root/A...pi.dll
windows10-2004-x64
3P990Root/A...pi.dll
windows7-x64
1P990Root/A...pi.dll
windows10-2004-x64
3P990Root/ADB/adb.exe
windows7-x64
1P990Root/ADB/adb.exe
windows10-2004-x64
1P990Root/ADB/adblinux
ubuntu-18.04-amd64
P990Root/ADB/adbmac
macos-10.15-amd64
1P990Root/D...usybox
debian-9-armhf
1P990Root/D...qlite3
debian-9-armhf
P990Root/E...rBreak
debian-9-armhf
P990Root/E...neuter
debian-9-armhf
1P990Root/R...er.apk
P990Root/R...er.apk
android-10-x64
P990Root/R...er.apk
android-11-x64
P990Root/Root/su-v1
debian-9-armhf
P990Root/Root/su-v2
debian-9-armhf
P990Root/Root/su-v3
debian-9-armhf
P990Root/S...ck.exe
windows7-x64
1P990Root/S...ck.exe
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
P990Root/ADB/AdbWinApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
P990Root/ADB/AdbWinApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
P990Root/ADB/AdbWinUsbApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
P990Root/ADB/AdbWinUsbApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
P990Root/ADB/adb.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
P990Root/ADB/adb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
P990Root/ADB/adblinux
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral8
Sample
P990Root/ADB/adbmac
Resource
macos-20231201-en
Behavioral task
behavioral9
Sample
P990Root/Dependencies/busybox
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral10
Sample
P990Root/Dependencies/sqlite3
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral11
Sample
P990Root/Exploits/GingerBreak
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral12
Sample
P990Root/Exploits/psneuter
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral13
Sample
P990Root/Root/Superuser.apk
Behavioral task
behavioral14
Sample
P990Root/Root/Superuser.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral15
Sample
P990Root/Root/Superuser.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral16
Sample
P990Root/Root/su-v1
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral17
Sample
P990Root/Root/su-v2
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral18
Sample
P990Root/Root/su-v3
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral19
Sample
P990Root/SuperOneClick.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
P990Root/SuperOneClick.exe
Resource
win10v2004-20231215-en
General
-
Target
P990Root/ADB/AdbWinUsbApi.dll
-
Size
59KB
-
MD5
5f23f2f936bdfac90bb0a4970ad365cf
-
SHA1
12e14244b1a5d04a261759547c3d930547f52fa3
-
SHA256
041c6859bb4fc78d3a903dd901298cd1ecfb75b6be0646b74954cd722280a407
-
SHA512
49a7769d5e6cb2fda9249039d90465f7a4e612805bba48b7036456a3bbd230e4d13da72e4ade5155ddc08fe460735ec8d6df3bb11b72ff28e1149221e2fc3048
-
SSDEEP
768:HLNk0yiFYWkgALpW+QvSugX0wUepQNXTQXdF+Q+An70edrqqOkIW:+yY8wugEwOVEXdz70e4gI
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3864 3168 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2768 wrote to memory of 3168 2768 rundll32.exe 87 PID 2768 wrote to memory of 3168 2768 rundll32.exe 87 PID 2768 wrote to memory of 3168 2768 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\P990Root\ADB\AdbWinUsbApi.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\P990Root\ADB\AdbWinUsbApi.dll,#12⤵PID:3168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 6163⤵
- Program crash
PID:3864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3168 -ip 31681⤵PID:4840