Overview
overview
9Static
static
7Loader/Per...er.bat
windows10-1703-x64
1Loader/Per...er.bat
windows10-2004-x64
1Loader/Render.exe
windows10-1703-x64
9Loader/Render.exe
windows10-2004-x64
9Loader/app..._2.exe
windows10-1703-x64
9Loader/app..._2.exe
windows10-2004-x64
9Loader/checker.exe
windows10-1703-x64
1Loader/checker.exe
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 11:06
Behavioral task
behavioral1
Sample
Loader/Permament_Mac_Changer.bat
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
Loader/Permament_Mac_Changer.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Loader/Render.exe
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
Loader/Render.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Loader/applecleaner_2.exe
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
Loader/applecleaner_2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Loader/checker.exe
Resource
win10-20240214-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
Loader/checker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
Loader/checker.exe
-
Size
89KB
-
MD5
818d090723ae48a45926a1ce0d6908d4
-
SHA1
e8db4f88fd48e65b600384cc1f35fbb159d0e365
-
SHA256
97b2611530393fda8377b0bac136c8960afea7fccba321faecb5927c3c971321
-
SHA512
14a97597f51ef967fc2ea453ec86719ea733a698d08e1b4a71edfcce86cc51dca0c090d68a1fe750dd699481dae82e29690119670d39c253776e7c79cf2dfb89
-
SSDEEP
1536:b7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfgwD:37DhdC6kzWypvaQ0FxyNTBfgm
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4528 WMIC.exe Token: SeSecurityPrivilege 4528 WMIC.exe Token: SeTakeOwnershipPrivilege 4528 WMIC.exe Token: SeLoadDriverPrivilege 4528 WMIC.exe Token: SeSystemProfilePrivilege 4528 WMIC.exe Token: SeSystemtimePrivilege 4528 WMIC.exe Token: SeProfSingleProcessPrivilege 4528 WMIC.exe Token: SeIncBasePriorityPrivilege 4528 WMIC.exe Token: SeCreatePagefilePrivilege 4528 WMIC.exe Token: SeBackupPrivilege 4528 WMIC.exe Token: SeRestorePrivilege 4528 WMIC.exe Token: SeShutdownPrivilege 4528 WMIC.exe Token: SeDebugPrivilege 4528 WMIC.exe Token: SeSystemEnvironmentPrivilege 4528 WMIC.exe Token: SeRemoteShutdownPrivilege 4528 WMIC.exe Token: SeUndockPrivilege 4528 WMIC.exe Token: SeManageVolumePrivilege 4528 WMIC.exe Token: 33 4528 WMIC.exe Token: 34 4528 WMIC.exe Token: 35 4528 WMIC.exe Token: 36 4528 WMIC.exe Token: SeIncreaseQuotaPrivilege 4528 WMIC.exe Token: SeSecurityPrivilege 4528 WMIC.exe Token: SeTakeOwnershipPrivilege 4528 WMIC.exe Token: SeLoadDriverPrivilege 4528 WMIC.exe Token: SeSystemProfilePrivilege 4528 WMIC.exe Token: SeSystemtimePrivilege 4528 WMIC.exe Token: SeProfSingleProcessPrivilege 4528 WMIC.exe Token: SeIncBasePriorityPrivilege 4528 WMIC.exe Token: SeCreatePagefilePrivilege 4528 WMIC.exe Token: SeBackupPrivilege 4528 WMIC.exe Token: SeRestorePrivilege 4528 WMIC.exe Token: SeShutdownPrivilege 4528 WMIC.exe Token: SeDebugPrivilege 4528 WMIC.exe Token: SeSystemEnvironmentPrivilege 4528 WMIC.exe Token: SeRemoteShutdownPrivilege 4528 WMIC.exe Token: SeUndockPrivilege 4528 WMIC.exe Token: SeManageVolumePrivilege 4528 WMIC.exe Token: 33 4528 WMIC.exe Token: 34 4528 WMIC.exe Token: 35 4528 WMIC.exe Token: 36 4528 WMIC.exe Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe Token: SeSecurityPrivilege 3732 WMIC.exe Token: SeTakeOwnershipPrivilege 3732 WMIC.exe Token: SeLoadDriverPrivilege 3732 WMIC.exe Token: SeSystemProfilePrivilege 3732 WMIC.exe Token: SeSystemtimePrivilege 3732 WMIC.exe Token: SeProfSingleProcessPrivilege 3732 WMIC.exe Token: SeIncBasePriorityPrivilege 3732 WMIC.exe Token: SeCreatePagefilePrivilege 3732 WMIC.exe Token: SeBackupPrivilege 3732 WMIC.exe Token: SeRestorePrivilege 3732 WMIC.exe Token: SeShutdownPrivilege 3732 WMIC.exe Token: SeDebugPrivilege 3732 WMIC.exe Token: SeSystemEnvironmentPrivilege 3732 WMIC.exe Token: SeRemoteShutdownPrivilege 3732 WMIC.exe Token: SeUndockPrivilege 3732 WMIC.exe Token: SeManageVolumePrivilege 3732 WMIC.exe Token: 33 3732 WMIC.exe Token: 34 3732 WMIC.exe Token: 35 3732 WMIC.exe Token: 36 3732 WMIC.exe Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3636 wrote to memory of 1632 3636 checker.exe 90 PID 3636 wrote to memory of 1632 3636 checker.exe 90 PID 1632 wrote to memory of 4528 1632 cmd.exe 91 PID 1632 wrote to memory of 4528 1632 cmd.exe 91 PID 1632 wrote to memory of 3732 1632 cmd.exe 93 PID 1632 wrote to memory of 3732 1632 cmd.exe 93 PID 1632 wrote to memory of 1116 1632 cmd.exe 94 PID 1632 wrote to memory of 1116 1632 cmd.exe 94 PID 1632 wrote to memory of 4536 1632 cmd.exe 96 PID 1632 wrote to memory of 4536 1632 cmd.exe 96 PID 1632 wrote to memory of 4136 1632 cmd.exe 98 PID 1632 wrote to memory of 4136 1632 cmd.exe 98 PID 1632 wrote to memory of 1128 1632 cmd.exe 99 PID 1632 wrote to memory of 1128 1632 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader\checker.exe"C:\Users\Admin\AppData\Local\Temp\Loader\checker.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4565.tmp\4566.tmp\4577.bat C:\Users\Admin\AppData\Local\Temp\Loader\checker.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get model, serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵PID:1116
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵PID:4536
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid3⤵PID:4136
-
-
C:\Windows\system32\getmac.exegetmac3⤵PID:1128
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
464B
MD5d6f1601b51ec89079d3578de0140697b
SHA194c4f537ec4bb9bef34cc9ecf1dadefba7a2a293
SHA2560a878891fb1dfb50ca41f954121e8b9540ff78b42abb9d7fe492cbdf675fe551
SHA5124f6831c48357a4a4b1c15692387f2121f3e5bf86a793fdbfd8881e17a0e92573bd8257ef385b503799a0222674ce378d7e272dcd2c9b6ffd60e56d1cdb1eb0f9