Overview
overview
9Static
static
7Loader/Per...er.bat
windows10-1703-x64
1Loader/Per...er.bat
windows10-2004-x64
1Loader/Render.exe
windows10-1703-x64
9Loader/Render.exe
windows10-2004-x64
9Loader/app..._2.exe
windows10-1703-x64
9Loader/app..._2.exe
windows10-2004-x64
9Loader/checker.exe
windows10-1703-x64
1Loader/checker.exe
windows10-2004-x64
1Analysis
-
max time kernel
128s -
max time network
130s -
platform
windows10-1703_x64 -
resource
win10-20240214-en -
resource tags
arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system -
submitted
09/03/2024, 11:06
Behavioral task
behavioral1
Sample
Loader/Permament_Mac_Changer.bat
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
Loader/Permament_Mac_Changer.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Loader/Render.exe
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
Loader/Render.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Loader/applecleaner_2.exe
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
Loader/applecleaner_2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Loader/checker.exe
Resource
win10-20240214-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
Loader/checker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
Loader/checker.exe
-
Size
89KB
-
MD5
818d090723ae48a45926a1ce0d6908d4
-
SHA1
e8db4f88fd48e65b600384cc1f35fbb159d0e365
-
SHA256
97b2611530393fda8377b0bac136c8960afea7fccba321faecb5927c3c971321
-
SHA512
14a97597f51ef967fc2ea453ec86719ea733a698d08e1b4a71edfcce86cc51dca0c090d68a1fe750dd699481dae82e29690119670d39c253776e7c79cf2dfb89
-
SSDEEP
1536:b7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfgwD:37DhdC6kzWypvaQ0FxyNTBfgm
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5044 WMIC.exe Token: SeSecurityPrivilege 5044 WMIC.exe Token: SeTakeOwnershipPrivilege 5044 WMIC.exe Token: SeLoadDriverPrivilege 5044 WMIC.exe Token: SeSystemProfilePrivilege 5044 WMIC.exe Token: SeSystemtimePrivilege 5044 WMIC.exe Token: SeProfSingleProcessPrivilege 5044 WMIC.exe Token: SeIncBasePriorityPrivilege 5044 WMIC.exe Token: SeCreatePagefilePrivilege 5044 WMIC.exe Token: SeBackupPrivilege 5044 WMIC.exe Token: SeRestorePrivilege 5044 WMIC.exe Token: SeShutdownPrivilege 5044 WMIC.exe Token: SeDebugPrivilege 5044 WMIC.exe Token: SeSystemEnvironmentPrivilege 5044 WMIC.exe Token: SeRemoteShutdownPrivilege 5044 WMIC.exe Token: SeUndockPrivilege 5044 WMIC.exe Token: SeManageVolumePrivilege 5044 WMIC.exe Token: 33 5044 WMIC.exe Token: 34 5044 WMIC.exe Token: 35 5044 WMIC.exe Token: 36 5044 WMIC.exe Token: SeIncreaseQuotaPrivilege 5044 WMIC.exe Token: SeSecurityPrivilege 5044 WMIC.exe Token: SeTakeOwnershipPrivilege 5044 WMIC.exe Token: SeLoadDriverPrivilege 5044 WMIC.exe Token: SeSystemProfilePrivilege 5044 WMIC.exe Token: SeSystemtimePrivilege 5044 WMIC.exe Token: SeProfSingleProcessPrivilege 5044 WMIC.exe Token: SeIncBasePriorityPrivilege 5044 WMIC.exe Token: SeCreatePagefilePrivilege 5044 WMIC.exe Token: SeBackupPrivilege 5044 WMIC.exe Token: SeRestorePrivilege 5044 WMIC.exe Token: SeShutdownPrivilege 5044 WMIC.exe Token: SeDebugPrivilege 5044 WMIC.exe Token: SeSystemEnvironmentPrivilege 5044 WMIC.exe Token: SeRemoteShutdownPrivilege 5044 WMIC.exe Token: SeUndockPrivilege 5044 WMIC.exe Token: SeManageVolumePrivilege 5044 WMIC.exe Token: 33 5044 WMIC.exe Token: 34 5044 WMIC.exe Token: 35 5044 WMIC.exe Token: 36 5044 WMIC.exe Token: SeIncreaseQuotaPrivilege 2384 WMIC.exe Token: SeSecurityPrivilege 2384 WMIC.exe Token: SeTakeOwnershipPrivilege 2384 WMIC.exe Token: SeLoadDriverPrivilege 2384 WMIC.exe Token: SeSystemProfilePrivilege 2384 WMIC.exe Token: SeSystemtimePrivilege 2384 WMIC.exe Token: SeProfSingleProcessPrivilege 2384 WMIC.exe Token: SeIncBasePriorityPrivilege 2384 WMIC.exe Token: SeCreatePagefilePrivilege 2384 WMIC.exe Token: SeBackupPrivilege 2384 WMIC.exe Token: SeRestorePrivilege 2384 WMIC.exe Token: SeShutdownPrivilege 2384 WMIC.exe Token: SeDebugPrivilege 2384 WMIC.exe Token: SeSystemEnvironmentPrivilege 2384 WMIC.exe Token: SeRemoteShutdownPrivilege 2384 WMIC.exe Token: SeUndockPrivilege 2384 WMIC.exe Token: SeManageVolumePrivilege 2384 WMIC.exe Token: 33 2384 WMIC.exe Token: 34 2384 WMIC.exe Token: 35 2384 WMIC.exe Token: 36 2384 WMIC.exe Token: SeIncreaseQuotaPrivilege 2384 WMIC.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2992 2724 checker.exe 76 PID 2724 wrote to memory of 2992 2724 checker.exe 76 PID 2992 wrote to memory of 5044 2992 cmd.exe 77 PID 2992 wrote to memory of 5044 2992 cmd.exe 77 PID 2992 wrote to memory of 2384 2992 cmd.exe 79 PID 2992 wrote to memory of 2384 2992 cmd.exe 79 PID 2992 wrote to memory of 1948 2992 cmd.exe 80 PID 2992 wrote to memory of 1948 2992 cmd.exe 80 PID 2992 wrote to memory of 868 2992 cmd.exe 81 PID 2992 wrote to memory of 868 2992 cmd.exe 81 PID 2992 wrote to memory of 4772 2992 cmd.exe 82 PID 2992 wrote to memory of 4772 2992 cmd.exe 82 PID 2992 wrote to memory of 4400 2992 cmd.exe 83 PID 2992 wrote to memory of 4400 2992 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader\checker.exe"C:\Users\Admin\AppData\Local\Temp\Loader\checker.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\72AF.tmp\72B0.tmp\72B1.bat C:\Users\Admin\AppData\Local\Temp\Loader\checker.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get model, serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵PID:1948
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵PID:868
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid3⤵PID:4772
-
-
C:\Windows\system32\getmac.exegetmac3⤵PID:4400
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
464B
MD5d6f1601b51ec89079d3578de0140697b
SHA194c4f537ec4bb9bef34cc9ecf1dadefba7a2a293
SHA2560a878891fb1dfb50ca41f954121e8b9540ff78b42abb9d7fe492cbdf675fe551
SHA5124f6831c48357a4a4b1c15692387f2121f3e5bf86a793fdbfd8881e17a0e92573bd8257ef385b503799a0222674ce378d7e272dcd2c9b6ffd60e56d1cdb1eb0f9