Overview
overview
10Static
static
3Launcher.dll
windows10-1703-x64
1Launcher.exe
windows10-1703-x64
10data/AppIn...Ep.ps1
windows10-1703-x64
1data/AppIn...lm.ps1
windows10-1703-x64
1data/AppIn...1k.ps1
windows10-1703-x64
1data/AppIn...jT.ps1
windows10-1703-x64
1data/AppIn...G1.ps1
windows10-1703-x64
1data/AppIn...Yy.ps1
windows10-1703-x64
1data/AppIn...er.dll
windows10-1703-x64
1data/AppIn...er.exe
windows10-1703-x64
3data/AppIn...AR.exe
windows10-1703-x64
4data/AppIn...er.dll
windows10-1703-x64
1data/AppIn...er.exe
windows10-1703-x64
3data/AppIn...et.exe
windows10-1703-x64
1data/AppIn...PS.ps1
windows10-1703-x64
1data/BLAKEX64.dll
windows10-1703-x64
1data/Data/...Tg.ps1
windows10-1703-x64
1data/Data/...mc.ps1
windows10-1703-x64
1data/Data/...eI.ps1
windows10-1703-x64
1data/Data/...1Z.ps1
windows10-1703-x64
1data/Qt5Core.dll
windows10-1703-x64
1data/TC7Z64.dll
windows10-1703-x64
1data/TCLZMA64.dll
windows10-1703-x64
1data/TCUNZL64.dll
windows10-1703-x64
1data/TCsha...64.dll
windows10-1703-x64
1data/Tools...0Z.ps1
windows10-1703-x64
1data/Tools...Ov.ps1
windows10-1703-x64
1data/Tools...XO.ps1
windows10-1703-x64
1data/UNRAR64.dll
windows10-1703-x64
1data/WCMICON2.dll
windows10-1703-x64
1data/WCMICONS.exe
windows10-1703-x64
3data/WCMZIP64.dll
windows10-1703-x64
1Analysis
-
max time kernel
115s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
23-02-2024 10:15
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.dll
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
Launcher.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
data/AppInfo/RIBTwoUATqEp.ps1
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
data/AppInfo/VO1DaL46eflm.ps1
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
data/AppInfo/WtFlkRqeJ61k.ps1
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
data/AppInfo/Xfh5GWnGPMjT.ps1
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
data/AppInfo/YwTGpGD7UtG1.ps1
Resource
win10-20240214-en
Behavioral task
behavioral8
Sample
data/AppInfo/kGCFZO6TPVYy.ps1
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
data/AppInfo/services/Launhcer.dll
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
data/AppInfo/services/Launhcer.exe
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
data/AppInfo/services/WinRAR.exe
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
data/AppInfo/services/data/Launcher.dll
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
data/AppInfo/services/data/Launcher.exe
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
data/AppInfo/services/wget.exe
Resource
win10-20240221-en
Behavioral task
behavioral15
Sample
data/AppInfo/vhXDYuQByxPS.ps1
Resource
win10-20240214-en
Behavioral task
behavioral16
Sample
data/BLAKEX64.dll
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
data/Data/QsVakRcJSHTg.ps1
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
data/Data/YXNOU01Xhpmc.ps1
Resource
win10-20240221-en
Behavioral task
behavioral19
Sample
data/Data/jqP27MaT7teI.ps1
Resource
win10-20240214-en
Behavioral task
behavioral20
Sample
data/Data/mtgtTlysOs1Z.ps1
Resource
win10-20240221-en
Behavioral task
behavioral21
Sample
data/Qt5Core.dll
Resource
win10-20240221-en
Behavioral task
behavioral22
Sample
data/TC7Z64.dll
Resource
win10-20240221-en
Behavioral task
behavioral23
Sample
data/TCLZMA64.dll
Resource
win10-20240221-en
Behavioral task
behavioral24
Sample
data/TCUNZL64.dll
Resource
win10-20240221-en
Behavioral task
behavioral25
Sample
data/TCshareWin10x64.dll
Resource
win10-20240221-en
Behavioral task
behavioral26
Sample
data/Tools/9syz0JDU8L0Z.ps1
Resource
win10-20240221-en
Behavioral task
behavioral27
Sample
data/Tools/NcHGDdjDw8Ov.ps1
Resource
win10-20240221-en
Behavioral task
behavioral28
Sample
data/Tools/dkAdSRKzVAXO.ps1
Resource
win10-20240221-en
Behavioral task
behavioral29
Sample
data/UNRAR64.dll
Resource
win10-20240221-en
Behavioral task
behavioral30
Sample
data/WCMICON2.dll
Resource
win10-20240221-en
Behavioral task
behavioral31
Sample
data/WCMICONS.exe
Resource
win10-20240221-en
Behavioral task
behavioral32
Sample
data/WCMZIP64.dll
Resource
win10-20240214-en
General
-
Target
data/Tools/dkAdSRKzVAXO.ps1
-
Size
60KB
-
MD5
4aa66ddabc029868bf1bd240538f968e
-
SHA1
e0d06de922e3b17c40d3a436e35ac9fe9cf61591
-
SHA256
12017694a32e244d52e0f97f103c631764fbdc864423b78da7a53767a82012a1
-
SHA512
5134b896cd63dd4ffb0caaffabd0cc68c8f06eae094d9fdca3abd8e6e3c7e760c5e1a3423925158c6e440b2d433d65b916d07eae847bd8879d496cdd4c0fce02
-
SSDEEP
1536:t2Eq1oKA4t5orzg0TClQ1u8C09oeM+Y+EXlBbZD8:tgBzt53lsbCstxeZo
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4848 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_edausfig.gxw.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
memory/4848-4-0x00007FFDE2120000-0x00007FFDE2B0C000-memory.dmpFilesize
9.9MB
-
memory/4848-5-0x000002ADE9E90000-0x000002ADE9EA0000-memory.dmpFilesize
64KB
-
memory/4848-7-0x000002ADE9E90000-0x000002ADE9EA0000-memory.dmpFilesize
64KB
-
memory/4848-6-0x000002ADE9EA0000-0x000002ADE9EC2000-memory.dmpFilesize
136KB
-
memory/4848-10-0x000002ADEA050000-0x000002ADEA0C6000-memory.dmpFilesize
472KB
-
memory/4848-32-0x000002ADE9E90000-0x000002ADE9EA0000-memory.dmpFilesize
64KB
-
memory/4848-34-0x00007FFDE2120000-0x00007FFDE2B0C000-memory.dmpFilesize
9.9MB
-
memory/4848-35-0x000002ADE9E90000-0x000002ADE9EA0000-memory.dmpFilesize
64KB
-
memory/4848-36-0x000002ADE9E90000-0x000002ADE9EA0000-memory.dmpFilesize
64KB
-
memory/4848-37-0x000002ADE9E90000-0x000002ADE9EA0000-memory.dmpFilesize
64KB