Overview
overview
10Static
static
3Launcher.dll
windows10-1703-x64
1Launcher.exe
windows10-1703-x64
10data/AppIn...Ep.ps1
windows10-1703-x64
1data/AppIn...lm.ps1
windows10-1703-x64
1data/AppIn...1k.ps1
windows10-1703-x64
1data/AppIn...jT.ps1
windows10-1703-x64
1data/AppIn...G1.ps1
windows10-1703-x64
1data/AppIn...Yy.ps1
windows10-1703-x64
1data/AppIn...er.dll
windows10-1703-x64
1data/AppIn...er.exe
windows10-1703-x64
3data/AppIn...AR.exe
windows10-1703-x64
4data/AppIn...er.dll
windows10-1703-x64
1data/AppIn...er.exe
windows10-1703-x64
3data/AppIn...et.exe
windows10-1703-x64
1data/AppIn...PS.ps1
windows10-1703-x64
1data/BLAKEX64.dll
windows10-1703-x64
1data/Data/...Tg.ps1
windows10-1703-x64
1data/Data/...mc.ps1
windows10-1703-x64
1data/Data/...eI.ps1
windows10-1703-x64
1data/Data/...1Z.ps1
windows10-1703-x64
1data/Qt5Core.dll
windows10-1703-x64
1data/TC7Z64.dll
windows10-1703-x64
1data/TCLZMA64.dll
windows10-1703-x64
1data/TCUNZL64.dll
windows10-1703-x64
1data/TCsha...64.dll
windows10-1703-x64
1data/Tools...0Z.ps1
windows10-1703-x64
1data/Tools...Ov.ps1
windows10-1703-x64
1data/Tools...XO.ps1
windows10-1703-x64
1data/UNRAR64.dll
windows10-1703-x64
1data/WCMICON2.dll
windows10-1703-x64
1data/WCMICONS.exe
windows10-1703-x64
3data/WCMZIP64.dll
windows10-1703-x64
1Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows10-1703_x64 -
resource
win10-20240214-en -
resource tags
arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system -
submitted
23-02-2024 10:15
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.dll
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
Launcher.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
data/AppInfo/RIBTwoUATqEp.ps1
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
data/AppInfo/VO1DaL46eflm.ps1
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
data/AppInfo/WtFlkRqeJ61k.ps1
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
data/AppInfo/Xfh5GWnGPMjT.ps1
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
data/AppInfo/YwTGpGD7UtG1.ps1
Resource
win10-20240214-en
Behavioral task
behavioral8
Sample
data/AppInfo/kGCFZO6TPVYy.ps1
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
data/AppInfo/services/Launhcer.dll
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
data/AppInfo/services/Launhcer.exe
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
data/AppInfo/services/WinRAR.exe
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
data/AppInfo/services/data/Launcher.dll
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
data/AppInfo/services/data/Launcher.exe
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
data/AppInfo/services/wget.exe
Resource
win10-20240221-en
Behavioral task
behavioral15
Sample
data/AppInfo/vhXDYuQByxPS.ps1
Resource
win10-20240214-en
Behavioral task
behavioral16
Sample
data/BLAKEX64.dll
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
data/Data/QsVakRcJSHTg.ps1
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
data/Data/YXNOU01Xhpmc.ps1
Resource
win10-20240221-en
Behavioral task
behavioral19
Sample
data/Data/jqP27MaT7teI.ps1
Resource
win10-20240214-en
Behavioral task
behavioral20
Sample
data/Data/mtgtTlysOs1Z.ps1
Resource
win10-20240221-en
Behavioral task
behavioral21
Sample
data/Qt5Core.dll
Resource
win10-20240221-en
Behavioral task
behavioral22
Sample
data/TC7Z64.dll
Resource
win10-20240221-en
Behavioral task
behavioral23
Sample
data/TCLZMA64.dll
Resource
win10-20240221-en
Behavioral task
behavioral24
Sample
data/TCUNZL64.dll
Resource
win10-20240221-en
Behavioral task
behavioral25
Sample
data/TCshareWin10x64.dll
Resource
win10-20240221-en
Behavioral task
behavioral26
Sample
data/Tools/9syz0JDU8L0Z.ps1
Resource
win10-20240221-en
Behavioral task
behavioral27
Sample
data/Tools/NcHGDdjDw8Ov.ps1
Resource
win10-20240221-en
Behavioral task
behavioral28
Sample
data/Tools/dkAdSRKzVAXO.ps1
Resource
win10-20240221-en
Behavioral task
behavioral29
Sample
data/UNRAR64.dll
Resource
win10-20240221-en
Behavioral task
behavioral30
Sample
data/WCMICON2.dll
Resource
win10-20240221-en
Behavioral task
behavioral31
Sample
data/WCMICONS.exe
Resource
win10-20240221-en
Behavioral task
behavioral32
Sample
data/WCMZIP64.dll
Resource
win10-20240214-en
General
-
Target
data/Data/jqP27MaT7teI.ps1
-
Size
70KB
-
MD5
b18b3ea6558ce745da6a48c6bc387a23
-
SHA1
eb6ee868efceb399552c8bdf18f4351c389d30f4
-
SHA256
d2ed00f6fcc712f76c910d998361e361261cb2ff838bdf83d4f76ac3d5b496bf
-
SHA512
fb79fbfc930ca4260f6ed6b7b7137f9f00890f7f15b539c52ef6e734b7f9da60b68ad6e00412b05300687f75fcc3d0be0a84ded584cce9f61d8f202612f8c41c
-
SSDEEP
1536:SUvUr2tIeCGe8W9M4Rk3lUVSDxOEDwn+i8YWC+ZH4loGI8s62Vc9:fntIene8KsG6OE8n+9YWRH4lXFx
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3168 powershell.exe 3168 powershell.exe 3168 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 3168 powershell.exe Token: 33 1200 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1200 AUDIODG.EXE
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\data\Data\jqP27MaT7teI.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x41c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5msxsfyw.pkv.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
memory/3168-4-0x00007FF8E6830000-0x00007FF8E721C000-memory.dmpFilesize
9.9MB
-
memory/3168-5-0x0000021C22490000-0x0000021C224B2000-memory.dmpFilesize
136KB
-
memory/3168-7-0x0000021C22500000-0x0000021C22510000-memory.dmpFilesize
64KB
-
memory/3168-6-0x0000021C22500000-0x0000021C22510000-memory.dmpFilesize
64KB
-
memory/3168-10-0x0000021C22790000-0x0000021C22806000-memory.dmpFilesize
472KB
-
memory/3168-31-0x0000021C22500000-0x0000021C22510000-memory.dmpFilesize
64KB
-
memory/3168-37-0x00007FF8E6830000-0x00007FF8E721C000-memory.dmpFilesize
9.9MB