Overview
overview
3Static
static
3app_links_plugin.dll
windows10-1703-x64
1data/app.so
windows10-1703-x64
3data/flutt...ll.bat
windows10-1703-x64
1data/flutt...er.exe
windows10-1703-x64
1data/flutt...ip.exe
windows10-1703-x64
1data/flutt...op.bat
windows10-1703-x64
1data/flutt...ar.exe
windows10-1703-x64
3data/flutt...lt.dll
windows10-1703-x64
1data/flutt...le.dll
windows10-1703-x64
1data/flutt...ak.dll
windows10-1703-x64
1data/flutt...ot.dll
windows10-1703-x64
1data/flutt...er.exe
windows10-1703-x64
1data/flutt...ll.bat
windows10-1703-x64
1data/flutt...ch.exe
windows10-1703-x64
1data/flutt...at.bat
windows10-1703-x64
1flutter_ac...in.dll
windows10-1703-x64
1flutter_windows.dll
windows10-1703-x64
1reboot_launcher.exe
windows10-1703-x64
1screen_ret...in.dll
windows10-1703-x64
1system_the...in.dll
windows10-1703-x64
1url_launch...in.dll
windows10-1703-x64
1window_man...in.dll
windows10-1703-x64
1windows_ta...in.dll
windows10-1703-x64
1Analysis
-
max time kernel
29s -
max time network
38s -
platform
windows10-1703_x64 -
resource
win10-20240214-en -
resource tags
arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system -
submitted
21-02-2024 15:27
Static task
static1
Behavioral task
behavioral1
Sample
app_links_plugin.dll
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
data/app.so
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
data/flutter_assets/assets/authenticator/kill.bat
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
data/flutter_assets/assets/authenticator/lawinserver.exe
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
data/flutter_assets/assets/build/7zip.exe
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
data/flutter_assets/assets/build/stop.bat
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
data/flutter_assets/assets/build/winrar.exe
Resource
win10-20240214-en
Behavioral task
behavioral8
Sample
data/flutter_assets/assets/dlls/cobalt.dll
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
data/flutter_assets/assets/dlls/console.dll
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
data/flutter_assets/assets/dlls/memoryleak.dll
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
data/flutter_assets/assets/dlls/reboot.dll
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
data/flutter_assets/assets/matchmaker/fortmatchmaker.exe
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
data/flutter_assets/assets/matchmaker/kill.bat
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
data/flutter_assets/assets/misc/watch.exe
Resource
win10-20240221-en
Behavioral task
behavioral15
Sample
data/flutter_assets/assets/misc/winnat.bat
Resource
win10-20240221-en
Behavioral task
behavioral16
Sample
flutter_acrylic_plugin.dll
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
flutter_windows.dll
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
reboot_launcher.exe
Resource
win10-20240214-en
Behavioral task
behavioral19
Sample
screen_retriever_plugin.dll
Resource
win10-20240221-en
Behavioral task
behavioral20
Sample
system_theme_plugin.dll
Resource
win10-20240221-en
Behavioral task
behavioral21
Sample
url_launcher_windows_plugin.dll
Resource
win10-20240221-en
Behavioral task
behavioral22
Sample
window_manager_plugin.dll
Resource
win10-20240221-en
Behavioral task
behavioral23
Sample
windows_taskbar_plugin.dll
Resource
win10-20240221-en
General
-
Target
reboot_launcher.exe
-
Size
131KB
-
MD5
6373a1b24e3af14a45554ce84b1734a7
-
SHA1
7ae5157e92347678f1dfc8d96fb8fa9256e89dfa
-
SHA256
9e737764c3f68841c331d5c28e6983df13e39fdec87076f30440e06d404086bb
-
SHA512
102c822f0701b61c87d7867256c47b966f7034d22b336b74dc399d4941f48712292450d62fb2603a139149b17a7fdf1505e01dd18ff3a3b032576b3f1f7417df
-
SSDEEP
3072:ypXW1kEx32ODnjbqV3dhK6d6hyg5rgzgMjkExRKmkN3xI7T4++2PwE:yNCkinDnEdhK6d6hyg5rgzgMjkKW3w4m
Malware Config
Signatures
-
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-820923436-2084397322-3365974649-1000_Classes\reboot\ = "URL:Reboot" reboot_launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-820923436-2084397322-3365974649-1000_Classes\reboot\URL Protocol reboot_launcher.exe Key created \REGISTRY\USER\S-1-5-21-820923436-2084397322-3365974649-1000_Classes\reboot\shell\open\command reboot_launcher.exe Key created \REGISTRY\USER\S-1-5-21-820923436-2084397322-3365974649-1000_Classes\reboot\shell reboot_launcher.exe Key created \REGISTRY\USER\S-1-5-21-820923436-2084397322-3365974649-1000_Classes\reboot\shell\open reboot_launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-820923436-2084397322-3365974649-1000_Classes\reboot\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\reboot_launcher.exe \"%1\"" reboot_launcher.exe Key created \REGISTRY\USER\S-1-5-21-820923436-2084397322-3365974649-1000_Classes\reboot reboot_launcher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1420 reboot_launcher.exe 1420 reboot_launcher.exe 1420 reboot_launcher.exe 1420 reboot_launcher.exe