Malware Analysis Report

2024-11-30 02:16

Sample ID 240327-vknwmsbg61
Target SKRIPTGG-FIVEM-main.zip
SHA256 38c5b0767ba5a3b10ad9a158b3493ae24096c2993994b06783d8f7266e3b4bc2
Tags
rhadamanthys pyinstaller stealer upx persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

38c5b0767ba5a3b10ad9a158b3493ae24096c2993994b06783d8f7266e3b4bc2

Threat Level: Known bad

The file SKRIPTGG-FIVEM-main.zip was found to be: Known bad.

Malicious Activity Summary

rhadamanthys pyinstaller stealer upx persistence

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Loads dropped DLL

Executes dropped EXE

UPX packed file

Checks computer location settings

Adds Run key to start application

Detects Pyinstaller

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-27 17:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:04

Platform

win7-20240215-en

Max time kernel

66s

Max time network

68s

Command Line

C:\Windows\Explorer.EXE

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2712 created 1196 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\Explorer.EXE

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1624 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 1624 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 1624 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2572 wrote to memory of 1596 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe
PID 2572 wrote to memory of 1596 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe
PID 2572 wrote to memory of 1596 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe
PID 2572 wrote to memory of 1596 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe
PID 2572 wrote to memory of 1596 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe
PID 2572 wrote to memory of 1596 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe
PID 2572 wrote to memory of 1596 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe
PID 1596 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 1596 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 1596 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 1596 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 1596 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 1596 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 1596 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 1596 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 1596 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 1596 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 1596 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 1940 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 1940 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 1940 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2712 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2712 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2712 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2712 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2712 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2712 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2712 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2712 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2712 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\Skript.rar

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\Skript.rar"

C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe

"C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAaQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZgBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAcgBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAYQBjACMAPgA="

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Users\Admin\AppData\Local\svchost.exe

"C:\Users\Admin\AppData\Local\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe

MD5 620024df612c13a4a33cf785384c2086
SHA1 a6ae999723bea18c6d3acf2c52ed682f6226b7be
SHA256 cd825788095cd61de39d98d6365ed80004cc55a64f4f115ef6bf532617bb0af1
SHA512 34d4d8a423d98bf0b8d4f18dc980bed97e9492f0817bb1e2dff99fc8d9d0cfaa2687514eff7717b1310a2c858236614490e980390612901e08b69b6ded451bdd

\Users\Admin\AppData\Local\Temp\explorer.exe

MD5 aba4fcf0d72b487887f315202bc43ae4
SHA1 de51440c742c58f52f3b7cc2a1fcda5abd3d1ca8
SHA256 8f312c17c2a525ac9bc0838e4d9f69db5bb20478ffa4880fb3a8b98caf0e25ef
SHA512 fed41d5eb4a61c43bb3032c0d0b3d347d6b89a06d2928155f2e0baa59295ae71d3e689c3c78a584f2db64fd5ab3a06578623a8d41d7055b535c4d2317aef2bf9

\Users\Admin\AppData\Local\svchost.exe

MD5 8a6f1580a5b9b94d7cd47cc6b1af1b9a
SHA1 e68768afd59e18091d345cb300e859572e8d4c5c
SHA256 bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe
SHA512 1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309

memory/2712-58-0x0000000000CC0000-0x0000000000D2D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI19402\python310.dll

MD5 3f782cf7874b03c1d20ed90d370f4329
SHA1 08a2b4a21092321de1dcad1bb2afb660b0fa7749
SHA256 2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6
SHA512 950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857

memory/2288-68-0x000007FEF61B0000-0x000007FEF6616000-memory.dmp

memory/2608-71-0x0000000073770000-0x0000000073D1B000-memory.dmp

memory/2608-72-0x0000000002BA0000-0x0000000002BE0000-memory.dmp

memory/2712-74-0x0000000003230000-0x0000000003630000-memory.dmp

memory/2712-73-0x0000000003230000-0x0000000003630000-memory.dmp

memory/2712-75-0x0000000077730000-0x00000000778D9000-memory.dmp

memory/2712-76-0x0000000003230000-0x0000000003630000-memory.dmp

memory/2712-78-0x00000000765A0000-0x00000000765E7000-memory.dmp

memory/2280-79-0x0000000000090000-0x0000000000099000-memory.dmp

memory/2712-81-0x0000000000CC0000-0x0000000000D2D000-memory.dmp

memory/2280-83-0x0000000000870000-0x0000000000C70000-memory.dmp

memory/2280-84-0x0000000077730000-0x00000000778D9000-memory.dmp

memory/2280-85-0x0000000000870000-0x0000000000C70000-memory.dmp

memory/2280-87-0x00000000765A0000-0x00000000765E7000-memory.dmp

memory/2608-88-0x0000000073770000-0x0000000073D1B000-memory.dmp

memory/2280-89-0x0000000000870000-0x0000000000C70000-memory.dmp

memory/2280-90-0x0000000077730000-0x00000000778D9000-memory.dmp

memory/2288-91-0x000007FEF61B0000-0x000007FEF6616000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:06

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\Skript.rar

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1040 wrote to memory of 936 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 1040 wrote to memory of 936 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\Skript.rar

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\Skript.rar"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 208.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 19.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 252.15.104.51.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:06

Platform

win7-20240221-en

Max time kernel

119s

Max time network

121s

Command Line

C:\Windows\Explorer.EXE

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2312 created 1200 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\Explorer.EXE

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2088 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2088 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2088 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2088 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2088 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 2088 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 2088 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 2088 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 2088 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 2088 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 2088 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 1728 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 1728 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 1728 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2312 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2312 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2312 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2312 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2312 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2312 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2312 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2312 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 2312 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\launcher.exe

"C:\Users\Admin\AppData\Local\Temp\launcher.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAaQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZgBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAcgBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAYQBjACMAPgA="

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Users\Admin\AppData\Local\svchost.exe

"C:\Users\Admin\AppData\Local\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\explorer.exe

MD5 aba4fcf0d72b487887f315202bc43ae4
SHA1 de51440c742c58f52f3b7cc2a1fcda5abd3d1ca8
SHA256 8f312c17c2a525ac9bc0838e4d9f69db5bb20478ffa4880fb3a8b98caf0e25ef
SHA512 fed41d5eb4a61c43bb3032c0d0b3d347d6b89a06d2928155f2e0baa59295ae71d3e689c3c78a584f2db64fd5ab3a06578623a8d41d7055b535c4d2317aef2bf9

C:\Users\Admin\AppData\Local\svchost.exe

MD5 8a6f1580a5b9b94d7cd47cc6b1af1b9a
SHA1 e68768afd59e18091d345cb300e859572e8d4c5c
SHA256 bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe
SHA512 1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309

memory/2312-15-0x0000000000C00000-0x0000000000C6D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI17282\python310.dll

MD5 3f782cf7874b03c1d20ed90d370f4329
SHA1 08a2b4a21092321de1dcad1bb2afb660b0fa7749
SHA256 2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6
SHA512 950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857

memory/2708-35-0x000007FEF5C90000-0x000007FEF60F6000-memory.dmp

memory/2016-36-0x0000000073DA0000-0x000000007434B000-memory.dmp

memory/2016-37-0x00000000029C0000-0x0000000002A00000-memory.dmp

memory/2312-38-0x0000000003220000-0x0000000003620000-memory.dmp

memory/2312-40-0x0000000003220000-0x0000000003620000-memory.dmp

memory/2312-41-0x0000000077070000-0x0000000077219000-memory.dmp

memory/2312-42-0x0000000003220000-0x0000000003620000-memory.dmp

memory/2312-44-0x00000000767B0000-0x00000000767F7000-memory.dmp

memory/2444-46-0x0000000000110000-0x0000000000119000-memory.dmp

memory/2016-45-0x0000000073DA0000-0x000000007434B000-memory.dmp

memory/2312-47-0x0000000000C00000-0x0000000000C6D000-memory.dmp

memory/2444-49-0x0000000001F20000-0x0000000002320000-memory.dmp

memory/2444-50-0x0000000001F20000-0x0000000002320000-memory.dmp

memory/2444-52-0x0000000001F20000-0x0000000002320000-memory.dmp

memory/2444-51-0x0000000077070000-0x0000000077219000-memory.dmp

memory/2444-55-0x00000000767B0000-0x00000000767F7000-memory.dmp

memory/2444-54-0x0000000077070000-0x0000000077219000-memory.dmp

memory/2444-56-0x0000000001F20000-0x0000000002320000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:06

Platform

win7-20240221-en

Max time kernel

119s

Max time network

124s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\README.md

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.md C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.md\ = "md_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\README.md

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\README.md

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\README.md"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 3d4858b0fa8adde8e522b448f6808926
SHA1 575c49b25d206152ed2953c77f949e7c36b4f56e
SHA256 ed9fd4b256cd5e8180d88d4e70dfacf61c24605ba9a0a87e7b25e9125f102e1c
SHA512 6be53fbe1e0ef15e22cc3af06ddc3a6dab275f3166c71d7b9db2e4e15429a71c50f9e8677f1c1236522f393ffa78b15dac822cab12dbf60690df6ef9f60dde31

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:06

Platform

win10v2004-20231215-en

Max time kernel

93s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\README.md

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\README.md

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 208.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 21.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 192.230.140.95.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 202.135.221.88.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:06

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

152s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1948 created 2644 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\system32\sihost.exe

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\launcher.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update64 = "C:\\Users\\Admin\\explorer.exe" C:\Users\Admin\explorer.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4524 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4524 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4524 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4524 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 4524 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 4524 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 4524 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 4524 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\launcher.exe C:\Users\Admin\AppData\Local\svchost.exe
PID 3164 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 3164 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2468 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\system32\cmd.exe
PID 2468 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\system32\cmd.exe
PID 4716 wrote to memory of 5000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4716 wrote to memory of 5000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4716 wrote to memory of 960 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\explorer.exe
PID 4716 wrote to memory of 960 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\explorer.exe
PID 960 wrote to memory of 2436 N/A C:\Users\Admin\explorer.exe C:\Users\Admin\explorer.exe
PID 960 wrote to memory of 2436 N/A C:\Users\Admin\explorer.exe C:\Users\Admin\explorer.exe
PID 2436 wrote to memory of 4996 N/A C:\Users\Admin\explorer.exe C:\Windows\system32\cmd.exe
PID 2436 wrote to memory of 4996 N/A C:\Users\Admin\explorer.exe C:\Windows\system32\cmd.exe
PID 1948 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 1948 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 1948 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 1948 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe
PID 1948 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\svchost.exe C:\Windows\SysWOW64\dialer.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\launcher.exe

"C:\Users\Admin\AppData\Local\Temp\launcher.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAaQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZgBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAcgBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAYQBjACMAPgA="

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Users\Admin\AppData\Local\svchost.exe

"C:\Users\Admin\AppData\Local\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\activate.bat

C:\Windows\system32\taskkill.exe

taskkill /f /im "explorer.exe"

C:\Users\Admin\explorer.exe

"explorer.exe"

C:\Users\Admin\explorer.exe

"explorer.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 3.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\explorer.exe

MD5 b1cd4255918f2a302887de1e58126383
SHA1 0947714b92643aa2bebd1cbac26d5fdc86697f46
SHA256 b8a367358370c9c18bd6c087f22c09aeeab7397b213ad018d806cf8809661ee0
SHA512 21010a00837ecc628131a323fa15c6c80caeac3354699e464275f7733838a7ac246913fec5a883ca982f122db887e2b1a37e215504331191fa2f3a289787f2be

C:\Users\Admin\AppData\Local\Temp\explorer.exe

MD5 0f4b9db69366bd9037bff0d0cf978653
SHA1 f0db205aeca85397e1cd43878c17669807bc415b
SHA256 b1d3d00c08943b444488fcbd0629e80e8bc672999e7641f21d97d33e8c2368d3
SHA512 0790531a77384b3323b3f39ecc2536bfc388eac8479518b269b8b46370a55b9dd274cdcb69f3f595e02f80663fa7b7f67b405f1c99a0d38a3250d88340335000

C:\Users\Admin\AppData\Local\svchost.exe

MD5 0068757fd0eafb983b261b644e988105
SHA1 46179b631b0232994b518990606c96abeb40daf7
SHA256 e380212dc52414a7345bf47c365e2f2b12114e31625591e894eac1a4526b0119
SHA512 2b71e7249cfb3dbe565f2845e9e70df7106a7d49059dc7c0b24e77a4bb42642750e91f0d8a12ee318976bb9bc124f2dda41cb6cf8cc4a3230f6af422db17b449

C:\Users\Admin\AppData\Local\Temp\_MEI31642\python310.dll

MD5 3f782cf7874b03c1d20ed90d370f4329
SHA1 08a2b4a21092321de1dcad1bb2afb660b0fa7749
SHA256 2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6
SHA512 950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857

C:\Users\Admin\AppData\Local\Temp\explorer.exe

MD5 aba4fcf0d72b487887f315202bc43ae4
SHA1 de51440c742c58f52f3b7cc2a1fcda5abd3d1ca8
SHA256 8f312c17c2a525ac9bc0838e4d9f69db5bb20478ffa4880fb3a8b98caf0e25ef
SHA512 fed41d5eb4a61c43bb3032c0d0b3d347d6b89a06d2928155f2e0baa59295ae71d3e689c3c78a584f2db64fd5ab3a06578623a8d41d7055b535c4d2317aef2bf9

C:\Users\Admin\AppData\Local\Temp\_MEI31642\VCRUNTIME140.dll

MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

memory/1948-34-0x0000000000B40000-0x0000000000BAD000-memory.dmp

C:\Users\Admin\AppData\Local\svchost.exe

MD5 8a6f1580a5b9b94d7cd47cc6b1af1b9a
SHA1 e68768afd59e18091d345cb300e859572e8d4c5c
SHA256 bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe
SHA512 1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309

memory/2468-39-0x00007FFB42C40000-0x00007FFB430A6000-memory.dmp

memory/860-38-0x00000000033B0000-0x00000000033E6000-memory.dmp

memory/860-40-0x00000000034A0000-0x00000000034B0000-memory.dmp

memory/2468-46-0x00007FFB57920000-0x00007FFB5792F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI31642\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

C:\Users\Admin\AppData\Local\Temp\_MEI31642\_bz2.pyd

MD5 f6e387f20808828796e876682a328e98
SHA1 6679ae43b0634ac706218996bac961bef4138a02
SHA256 8886bd30421c6c6bfae17847002b9bf4ee4d9eee1a3be7369ee66b36e26c372b
SHA512 ad7cf281f2d830f9dbf66d8ef50e418b4a17a0144b6616c43d7e98b00e6f0cbafc6fe4aba4fabf2f008bb0df85553614b38ae303e5726621a804051d950e744e

C:\Users\Admin\AppData\Local\Temp\_MEI31642\_lzma.pyd

MD5 7c66f33a67fbb4d99041f085ef3c6428
SHA1 e1384891df177b45b889459c503985b113e754a3
SHA256 32f911e178fa9e4db9bd797598f84f9896f99e5022f2b76a1589b81f686b0866
SHA512 d0caabd031fa0c63f4cfb79d8f3531ad85eda468d77a78dd3dde40ce9ac2d404fc0099c4f67579aa802fe5c6c6a464894fd88c19f1fc601f26189780b36f3f9d

memory/860-62-0x0000000072E00000-0x00000000735B0000-memory.dmp

memory/860-63-0x0000000005B60000-0x0000000006188000-memory.dmp

memory/2468-65-0x00007FFB52300000-0x00007FFB5232C000-memory.dmp

memory/860-66-0x00000000034A0000-0x00000000034B0000-memory.dmp

memory/2468-64-0x00007FFB52BB0000-0x00007FFB52BD4000-memory.dmp

memory/2468-67-0x00007FFB524A0000-0x00007FFB524B8000-memory.dmp

C:\Users\Admin\activate.bat

MD5 fbcbd43fa00e29f002495e4ab2dc4782
SHA1 75aad7a3fa21226bf37ff89da953743d2b650dc0
SHA256 7a58a034c76b65053744b7d2a443e487e1993aab50642a62f7f388d223e5f648
SHA512 4f26971331fbe1d40e65d493f9417ebcca5e331b61285da2575629b7cd57bdb35ec480cf3ef9a1df48c949360ba9038797575a6181d79b52e1092e4f98bebb3e

C:\Users\Admin\AppData\Local\Temp\_MEI31642\_socket.pyd

MD5 0dd957099cf15d172d0a343886fb7c66
SHA1 950f7f15c6accffac699c5db6ce475365821b92a
SHA256 8142d92dc7557e8c585ea9ee41146b77864b7529ed464fdf51dfb6d797828a4a
SHA512 3dc0380dfc871d8cab7e95d6119f16be2f31cdde784f8f90ffddd6a43323a2988c61e343eede5e5cb347fc2af594fe8d8944644396faf2e478a3487bcf9cf9ee

memory/860-69-0x00000000059C0000-0x00000000059E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI31642\_hashlib.pyd

MD5 13f99120a244ab62af1684fbbc5d5a7e
SHA1 5147a90082eb3cd2c34b7f2deb8a4ef24d7ae724
SHA256 11658b52e7166da976abeeed78a940d69b2f11f518046877bea799759a17f58b
SHA512 46c2f9f43df6de72458ed24c2a0433a6092fd5b49b3234135f06c19a80f18f8bdbfb297e5a411cf29f8c60af342c80db123959f7317cfa045c73bd6f835eb22d

memory/860-70-0x0000000006300000-0x0000000006366000-memory.dmp

memory/860-71-0x0000000006370000-0x00000000063D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4u2pygra.qgp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\_MEI31642\_decimal.pyd

MD5 2030438e4f397a7d4241a701a3ca2419
SHA1 28b8d06135cd1f784ccabda39432cc83ba22daf7
SHA256 07d7ac065f25af2c7498d5d93b1551cc43a4d4b5e8fb2f9293b647d0f7bd7c72
SHA512 767f2a9f9eef6ebeca95ab9652b7d0976f2ac87b9e9da1dbd3c4ccf58e8ecb0da8242f4df0b07612282c16ba85197ed0296d1052027cd48b96d61bdf678abaad

C:\Users\Admin\AppData\Local\Temp\_MEI31642\unicodedata.pyd

MD5 dfa1f0cd0ad295b31cb9dda2803bbd8c
SHA1 cc68460feae2ff4e9d85a72be58c8011cb318bc2
SHA256 46a90852f6651f20b7c89e71cc63f0154f00a0e7cd543f046020d5ec9ef6cb10
SHA512 7fbdfd56e12c8f030483f4d033f1b920968ea87687e9896f418e9cf1b9e345e2be2dc8f1ea1a8afb0040a376ffb7a5dc0db27d84fb8291b50e2ed3b10c10168e

C:\Users\Admin\AppData\Local\Temp\_MEI31642\select.pyd

MD5 5c66bcf3cc3c364ecac7cf40ad28d8f0
SHA1 faf0848c231bf120dc9f749f726c807874d9d612
SHA256 26dada1a4730a51a0e3aa62e7abc7e6517a4dc48f02616e0b6e5291014a809cc
SHA512 034cd4c70c4e0d95d6bb3f72751c07b8b91918aabe59abf9009c60aa22600247694d6b9e232fefff78868aad20f5f5548e8740659036096fab44b65f6c4f8db6

C:\Users\Admin\AppData\Local\Temp\_MEI31642\libcrypto-1_1.dll

MD5 e5aecaf59c67d6dd7c7979dfb49ed3b0
SHA1 b0a292065e1b3875f015277b90d183b875451450
SHA256 9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1
SHA512 145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

C:\Users\Admin\AppData\Local\Temp\_MEI31642\_ctypes.pyd

MD5 48ce90022e97f72114a95630ba43b8fb
SHA1 f2eba0434ec204d8c6ca4f01af33ef34f09b52fd
SHA256 5998de3112a710248d29df76a05272775bf08a8dbc5a051a7ecb909fef069635
SHA512 7e6c2591805136f74c413b9633d5fdc4428e6f01e0e632b278bee98170b4f418ef2afd237c09e60b0e72076924ed0e3ffb0e2453e543b5e030b263f64568fab8

C:\Users\Admin\AppData\Local\Temp\_MEI31642\base_library.zip

MD5 483d9675ef53a13327e7dfc7d09f23fe
SHA1 2378f1db6292cd8dc4ad95763a42ad49aeb11337
SHA256 70c28ec0770edefcef46fa27aaa08ba8dc22a31acd6f84cb0b99257dca1b629e
SHA512 f905eb1817d7d4cc1f65e3a5a01bade761bca15c4a24af7097bc8f3f2b43b00e000d6ea23cd054c391d3fdc2f1114f2af43c8bb6d97c1a0ce747763260a864f5

memory/860-81-0x00000000064E0000-0x0000000006834000-memory.dmp

memory/2468-82-0x00007FFB42C40000-0x00007FFB430A6000-memory.dmp

memory/860-87-0x00000000069A0000-0x00000000069BE000-memory.dmp

C:\Users\Admin\explorer.exe

MD5 329f3a2afc0d1aa4181a9dfae3e229b6
SHA1 e3674ec352b466650c8b1482d4b7bee560167fa9
SHA256 6730cfbcbcbc3dbf8e51357eaf73998f39f9cec525e9338a203ef346ecb71203
SHA512 0ebee905dc8f3ee32b8e88b4b1d71de801f5b486264b810f3201d51f338a4b69316cb8febbfa90ddda35292de84b8da9a6c0c1a746c4cc94517f5365da9d8d50

memory/860-91-0x00000000069C0000-0x0000000006A0C000-memory.dmp

memory/2436-110-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

memory/2436-124-0x00007FFB52300000-0x00007FFB52324000-memory.dmp

memory/2436-129-0x00007FFB57920000-0x00007FFB5792F000-memory.dmp

memory/2436-130-0x00007FFB52030000-0x00007FFB5205C000-memory.dmp

memory/2436-131-0x00007FFB52280000-0x00007FFB52299000-memory.dmp

memory/2436-133-0x00007FFB524A0000-0x00007FFB524B8000-memory.dmp

memory/2436-132-0x00007FFB55E60000-0x00007FFB55E6D000-memory.dmp

memory/1948-134-0x0000000003C00000-0x0000000004000000-memory.dmp

memory/1948-135-0x0000000003C00000-0x0000000004000000-memory.dmp

memory/1948-136-0x0000000003C00000-0x0000000004000000-memory.dmp

memory/1948-137-0x00007FFB60E50000-0x00007FFB61045000-memory.dmp

memory/1948-138-0x0000000003C00000-0x0000000004000000-memory.dmp

memory/1948-140-0x0000000075A70000-0x0000000075C85000-memory.dmp

memory/860-142-0x0000000006F50000-0x0000000006F82000-memory.dmp

memory/860-144-0x0000000073790000-0x00000000737DC000-memory.dmp

memory/860-143-0x000000007F010000-0x000000007F020000-memory.dmp

memory/1948-145-0x0000000000B40000-0x0000000000BAD000-memory.dmp

memory/860-155-0x0000000006F10000-0x0000000006F2E000-memory.dmp

memory/860-156-0x00000000034A0000-0x00000000034B0000-memory.dmp

memory/4704-141-0x0000000000500000-0x0000000000509000-memory.dmp

memory/4704-161-0x00007FFB60E50000-0x00007FFB61045000-memory.dmp

memory/860-160-0x00000000034A0000-0x00000000034B0000-memory.dmp

memory/4704-159-0x0000000002090000-0x0000000002490000-memory.dmp

memory/860-158-0x0000000006F90000-0x0000000007033000-memory.dmp

memory/860-162-0x0000000072E00000-0x00000000735B0000-memory.dmp

memory/4704-163-0x0000000002090000-0x0000000002490000-memory.dmp

memory/4704-165-0x0000000075A70000-0x0000000075C85000-memory.dmp

memory/860-166-0x00000000082E0000-0x000000000895A000-memory.dmp

memory/860-167-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

memory/4704-168-0x0000000002090000-0x0000000002490000-memory.dmp

memory/860-169-0x0000000007D10000-0x0000000007D1A000-memory.dmp

memory/860-170-0x0000000007F30000-0x0000000007FC6000-memory.dmp

memory/860-171-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

memory/860-172-0x0000000007EE0000-0x0000000007EEE000-memory.dmp

memory/860-173-0x0000000007EF0000-0x0000000007F04000-memory.dmp

memory/860-174-0x0000000007FD0000-0x0000000007FEA000-memory.dmp

memory/860-175-0x0000000007F20000-0x0000000007F28000-memory.dmp

memory/860-178-0x0000000072E00000-0x00000000735B0000-memory.dmp

memory/2436-179-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

memory/2436-180-0x00007FFB52300000-0x00007FFB52324000-memory.dmp

memory/2436-181-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

memory/2436-188-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

memory/2436-195-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

memory/2436-202-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

memory/2436-209-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

memory/2436-216-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

memory/2436-223-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

memory/2436-230-0x00007FFB425D0000-0x00007FFB42A36000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:06

Platform

win7-20240221-en

Max time kernel

118s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\license.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\license.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:06

Platform

win10v2004-20240226-en

Max time kernel

124s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\license.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\license.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 83.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 192.230.140.95.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:06

Platform

win7-20240221-en

Max time kernel

120s

Max time network

121s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main.zip

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-27 17:03

Reported

2024-03-27 17:06

Platform

win10v2004-20240226-en

Max time kernel

138s

Max time network

124s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main.zip

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 40.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 192.230.140.95.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
IE 52.111.236.23:443 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A