Overview
overview
10Static
static
3Launcher.dll
windows10-1703-x64
1Launcher.exe
windows10-1703-x64
10data/AppIn...Ep.ps1
windows10-1703-x64
1data/AppIn...lm.ps1
windows10-1703-x64
1data/AppIn...1k.ps1
windows10-1703-x64
1data/AppIn...jT.ps1
windows10-1703-x64
1data/AppIn...G1.ps1
windows10-1703-x64
1data/AppIn...Yy.ps1
windows10-1703-x64
1data/AppIn...er.dll
windows10-1703-x64
1data/AppIn...er.exe
windows10-1703-x64
3data/AppIn...AR.exe
windows10-1703-x64
4data/AppIn...er.dll
windows10-1703-x64
1data/AppIn...er.exe
windows10-1703-x64
3data/AppIn...et.exe
windows10-1703-x64
1data/AppIn...PS.ps1
windows10-1703-x64
1data/BLAKEX64.dll
windows10-1703-x64
1data/Data/...Tg.ps1
windows10-1703-x64
1data/Data/...mc.ps1
windows10-1703-x64
1data/Data/...eI.ps1
windows10-1703-x64
1data/Data/...1Z.ps1
windows10-1703-x64
1data/Qt5Core.dll
windows10-1703-x64
1data/TC7Z64.dll
windows10-1703-x64
1data/TCLZMA64.dll
windows10-1703-x64
1data/TCUNZL64.dll
windows10-1703-x64
1data/TCsha...64.dll
windows10-1703-x64
1data/Tools...0Z.ps1
windows10-1703-x64
1data/Tools...Ov.ps1
windows10-1703-x64
1data/Tools...XO.ps1
windows10-1703-x64
1data/UNRAR64.dll
windows10-1703-x64
1data/WCMICON2.dll
windows10-1703-x64
1data/WCMICONS.exe
windows10-1703-x64
3data/WCMZIP64.dll
windows10-1703-x64
1Analysis
-
max time kernel
118s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
23-02-2024 10:15
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.dll
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
Launcher.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
data/AppInfo/RIBTwoUATqEp.ps1
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
data/AppInfo/VO1DaL46eflm.ps1
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
data/AppInfo/WtFlkRqeJ61k.ps1
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
data/AppInfo/Xfh5GWnGPMjT.ps1
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
data/AppInfo/YwTGpGD7UtG1.ps1
Resource
win10-20240214-en
Behavioral task
behavioral8
Sample
data/AppInfo/kGCFZO6TPVYy.ps1
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
data/AppInfo/services/Launhcer.dll
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
data/AppInfo/services/Launhcer.exe
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
data/AppInfo/services/WinRAR.exe
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
data/AppInfo/services/data/Launcher.dll
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
data/AppInfo/services/data/Launcher.exe
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
data/AppInfo/services/wget.exe
Resource
win10-20240221-en
Behavioral task
behavioral15
Sample
data/AppInfo/vhXDYuQByxPS.ps1
Resource
win10-20240214-en
Behavioral task
behavioral16
Sample
data/BLAKEX64.dll
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
data/Data/QsVakRcJSHTg.ps1
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
data/Data/YXNOU01Xhpmc.ps1
Resource
win10-20240221-en
Behavioral task
behavioral19
Sample
data/Data/jqP27MaT7teI.ps1
Resource
win10-20240214-en
Behavioral task
behavioral20
Sample
data/Data/mtgtTlysOs1Z.ps1
Resource
win10-20240221-en
Behavioral task
behavioral21
Sample
data/Qt5Core.dll
Resource
win10-20240221-en
Behavioral task
behavioral22
Sample
data/TC7Z64.dll
Resource
win10-20240221-en
Behavioral task
behavioral23
Sample
data/TCLZMA64.dll
Resource
win10-20240221-en
Behavioral task
behavioral24
Sample
data/TCUNZL64.dll
Resource
win10-20240221-en
Behavioral task
behavioral25
Sample
data/TCshareWin10x64.dll
Resource
win10-20240221-en
Behavioral task
behavioral26
Sample
data/Tools/9syz0JDU8L0Z.ps1
Resource
win10-20240221-en
Behavioral task
behavioral27
Sample
data/Tools/NcHGDdjDw8Ov.ps1
Resource
win10-20240221-en
Behavioral task
behavioral28
Sample
data/Tools/dkAdSRKzVAXO.ps1
Resource
win10-20240221-en
Behavioral task
behavioral29
Sample
data/UNRAR64.dll
Resource
win10-20240221-en
Behavioral task
behavioral30
Sample
data/WCMICON2.dll
Resource
win10-20240221-en
Behavioral task
behavioral31
Sample
data/WCMICONS.exe
Resource
win10-20240221-en
Behavioral task
behavioral32
Sample
data/WCMZIP64.dll
Resource
win10-20240214-en
General
-
Target
data/AppInfo/RIBTwoUATqEp.ps1
-
Size
50KB
-
MD5
8618603555e100c4d43a2df960daf2c3
-
SHA1
65ccc35d4362f7889d44da6df8f769aafa198c16
-
SHA256
d88ecb816adc565e3f81cc7e66768f18f30d88c67cad231b7dca7516083964d0
-
SHA512
10895c4058a8ea1a22f054b08dd67c826b8aba441d3ee1f64c2723b51e87edb4f22912f33b883c98fda940c007c9d90441f19dd296cdd2dd80cc7c71e147b1b0
-
SSDEEP
1536:bmwLrmODq0OorurbxO9Pshw0IMCxbh/Tto:ywndDqjo3Wyhpo
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1364 powershell.exe 1364 powershell.exe 1364 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1364 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e5pncfkb.0xq.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
memory/1364-4-0x000002AF3AAC0000-0x000002AF3AAE2000-memory.dmpFilesize
136KB
-
memory/1364-5-0x00007FFAABF20000-0x00007FFAAC90C000-memory.dmpFilesize
9.9MB
-
memory/1364-8-0x000002AF3AA30000-0x000002AF3AA40000-memory.dmpFilesize
64KB
-
memory/1364-9-0x000002AF3AA30000-0x000002AF3AA40000-memory.dmpFilesize
64KB
-
memory/1364-10-0x000002AF53270000-0x000002AF532E6000-memory.dmpFilesize
472KB
-
memory/1364-31-0x000002AF3AA30000-0x000002AF3AA40000-memory.dmpFilesize
64KB
-
memory/1364-34-0x00007FFAABF20000-0x00007FFAAC90C000-memory.dmpFilesize
9.9MB
-
memory/1364-35-0x000002AF3AA30000-0x000002AF3AA40000-memory.dmpFilesize
64KB
-
memory/1364-36-0x000002AF3AA30000-0x000002AF3AA40000-memory.dmpFilesize
64KB
-
memory/1364-37-0x000002AF3AA30000-0x000002AF3AA40000-memory.dmpFilesize
64KB