Overview
overview
4Static
static
32bsk.zip
windows11-21h2-x64
12bsk/!!!Re...!!.txt
windows11-21h2-x64
32bsk/Gold WareZ.nfo
windows11-21h2-x64
12bsk/Readme.txt
windows11-21h2-x64
32bsk/crack.rar
windows11-21h2-x64
32bsk/groceryc.dll
windows11-21h2-x64
32bsk/mobik...er.exe
windows11-21h2-x64
4Resources/...al.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/...al.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/...al.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/loading.gif
windows11-21h2-x64
1Resources/...it.png
windows11-21h2-x64
3Resources/...ow.png
windows11-21h2-x64
3Resources/...wn.png
windows11-21h2-x64
3Resources/...up.png
windows11-21h2-x64
3Resources/...it.png
windows11-21h2-x64
3Resources/...il.png
windows11-21h2-x64
3Resources/...ey.png
windows11-21h2-x64
3Resources/...no.png
windows11-21h2-x64
3Resources/...re.png
windows11-21h2-x64
3Resources/...er.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/...er.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/...es.png
windows11-21h2-x64
3bubble.html
windows11-21h2-x64
1license.txt
windows11-21h2-x64
3template.html
windows11-21h2-x64
1uninst.exe
windows11-21h2-x64
4Analysis
-
max time kernel
92s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-02-2024 00:20
Static task
static1
Behavioral task
behavioral1
Sample
2bsk.zip
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
2bsk/!!!Readme_first!!!!.txt
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
2bsk/Gold WareZ.nfo
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
2bsk/Readme.txt
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
2bsk/crack.rar
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
2bsk/groceryc.dll
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
2bsk/mobikin-heic-to-jpg-converter.exe
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
Resources/close-normal.png
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
Resources/close-pressed.png
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
Resources/dialog/slide-down-normal.png
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
Resources/dialog/slide-down-pressed.png
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
Resources/dialog/take-back-normal.png
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
Resources/dialog/take-back-pressed.png
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
Resources/loading.gif
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
Resources/preview-edit.png
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
Resources/register/buy-now.png
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
Resources/register/dropdown.png
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
Resources/register/dropup.png
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
Resources/register/edit.png
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
Resources/register/email.png
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
Resources/register/key.png
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
Resources/register/no.png
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
Resources/register/read-more.png
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
Resources/register/register.png
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
Resources/register/registered.png
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
Resources/register/tip-register.png
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
Resources/register/unregistered.png
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
Resources/register/yes.png
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
bubble.html
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
license.txt
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
template.html
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
uninst.exe
Resource
win11-20240221-en
General
-
Target
2bsk/groceryc.dll
-
Size
439KB
-
MD5
daf3578f35284839a3d91f4f98eeb584
-
SHA1
70114e57427917e7c10bb4ad49db6d2067c087e2
-
SHA256
acffda33a6558465d61bfabc2a52d0353a7d4a46788f98cb8ea49245c71c541e
-
SHA512
2f7cfd0772aadac9aa6ff8b540e95847dd999a413314c0e07d00b2f595a6fcfc00095506cfd7114c29bba8542926d073ac42b683671858d6a12ffcbca63e140c
-
SSDEEP
12288:+Hcl+zBk/t5Z+OeO+OeNhBBhhBBUDwyV/T+KdL2:+HclsK5nDwyV/T+4L2
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2168 1008 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3640 wrote to memory of 1008 3640 rundll32.exe 80 PID 3640 wrote to memory of 1008 3640 rundll32.exe 80 PID 3640 wrote to memory of 1008 3640 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2bsk\groceryc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2bsk\groceryc.dll,#12⤵PID:1008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 5363⤵
- Program crash
PID:2168
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1008 -ip 10081⤵PID:3120