Malware Analysis Report

2024-11-15 05:59

Sample ID 240404-n8ngfsef2y
Target Installer.GitHub.rar
SHA256 1135081bde2464c28692eb7704cb4b286a6045f014e7b083824b2d72dd7dc3ba
Tags
rhadamanthys stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1135081bde2464c28692eb7704cb4b286a6045f014e7b083824b2d72dd7dc3ba

Threat Level: Known bad

The file Installer.GitHub.rar was found to be: Known bad.

Malicious Activity Summary

rhadamanthys stealer

Suspicious use of NtCreateUserProcessOtherParentProcess

Rhadamanthys

Loads dropped DLL

Executes dropped EXE

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-04-04 12:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

444s

Max time network

1170s

Command Line

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\libs\xmlfilter.dll"

Signatures

N/A

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\libs\xmlfilter.dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.73.50.20.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

1792s

Max time network

1803s

Command Line

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\libs\xmlprovi.dll"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeManageVolumePrivilege N/A C:\Windows\System32\svchost.exe N/A

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\libs\xmlprovi.dll"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2136 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k UnistackSvcGroup

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.179.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 167.161.23.2.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 136.111.86.104.in-addr.arpa udp
US 8.8.8.8:53 145.111.86.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 147.111.86.104.in-addr.arpa udp

Files

memory/3188-0-0x00000157BDC40000-0x00000157BDC50000-memory.dmp

memory/3188-16-0x00000157BDD40000-0x00000157BDD50000-memory.dmp

memory/3188-32-0x00000157C6070000-0x00000157C6071000-memory.dmp

memory/3188-34-0x00000157C60A0000-0x00000157C60A1000-memory.dmp

memory/3188-35-0x00000157C60A0000-0x00000157C60A1000-memory.dmp

memory/3188-36-0x00000157C61B0000-0x00000157C61B1000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

441s

Max time network

1169s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\BluetoothDesktopHandlers - Copy.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\BluetoothDesktopHandlers - Copy.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20231215-en

Max time kernel

1168s

Max time network

1171s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\BluetoothDesktopHandlers.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\BluetoothDesktopHandlers.dll",#1

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 226.162.46.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:46

Platform

win10v2004-20240226-en

Max time kernel

798s

Max time network

1176s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\trading_api64 - Copy.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\trading_api64 - Copy.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

1684s

Max time network

1709s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\3.dll",#1

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeManageVolumePrivilege N/A C:\Windows\System32\svchost.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\3.dll",#1

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k UnistackSvcGroup

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 167.161.23.2.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 33.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 210.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

memory/4864-0-0x000001F92BF40000-0x000001F92BF50000-memory.dmp

memory/4864-16-0x000001F92C040000-0x000001F92C050000-memory.dmp

memory/4864-32-0x000001F9345E0000-0x000001F9345E1000-memory.dmp

memory/4864-33-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-34-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-35-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-36-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-37-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-38-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-39-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-40-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-41-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-42-0x000001F934610000-0x000001F934611000-memory.dmp

memory/4864-43-0x000001F934230000-0x000001F934231000-memory.dmp

memory/4864-44-0x000001F934220000-0x000001F934221000-memory.dmp

memory/4864-46-0x000001F934230000-0x000001F934231000-memory.dmp

memory/4864-49-0x000001F934220000-0x000001F934221000-memory.dmp

memory/4864-52-0x000001F934160000-0x000001F934161000-memory.dmp

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

MD5 25074a416be4a6cdc39b077c1de24e49
SHA1 b8b16097fa5477a083c5406299a6e9662e490e77
SHA256 efcef519f9f4d62e24bcfdd55311dd1be70a65b873c7268265b7e32dbd4dc2a2
SHA512 182f24fc047af0b2f023ddae2624513033dd916168e1fe3a5fa53747171a75c4e05fdfe239e9e8f57e0dfa32150dd385691dc69826d937490d6cf3e0b36ced4d

memory/4864-64-0x000001F934360000-0x000001F934361000-memory.dmp

memory/4864-66-0x000001F934370000-0x000001F934371000-memory.dmp

memory/4864-67-0x000001F934370000-0x000001F934371000-memory.dmp

memory/4864-68-0x000001F934480000-0x000001F934481000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

445s

Max time network

1168s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WinFax.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WinFax.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 252.15.104.51.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240319-en

Max time kernel

1792s

Max time network

1804s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\libs\xolehlp.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\libs\xolehlp.dll",#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3836 --field-trial-handle=2232,i,10468259530860544675,2192522633371581869,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=2232,i,10468259530860544675,2192522633371581869,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 167.161.23.2.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.200.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

1333s

Max time network

1174s

Command Line

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WinOpcIrmProtector.dll"

Signatures

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8}\1.0\HELPDIR C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\OpcIrmProtector.DLL C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\OpcIrmProtector.DLL\AppID = "{002B3649-2094-468B-88E0-838AB549B5D3}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector\CLSID\ = "{B6FFEC3A-07F7-42D0-8829-B722F46DB533}" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6FFEC3A-07F7-42D0-8829-B722F46DB533}\TypeLib C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8}\1.0\ = "OpcIrmProtector 1.0 Type Library" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector.1\CLSID\ = "{B6FFEC3A-07F7-42D0-8829-B722F46DB533}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector\CurVer\ = "WinOpcIrmProtector.WinOpcIrmProtector.1" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8}\1.0 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{002B3649-2094-468B-88E0-838AB549B5D3}\ = "WinOpcIrmProtector" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector.1\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6FFEC3A-07F7-42D0-8829-B722F46DB533}\Programmable C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8}\1.0\FLAGS\ = "0" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6FFEC3A-07F7-42D0-8829-B722F46DB533}\ProgID C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector\ = "WinOpcIrmProtector Class" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6FFEC3A-07F7-42D0-8829-B722F46DB533}\VersionIndependentProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{002B3649-2094-468B-88E0-838AB549B5D3} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector.1\ = "WinOpcIrmProtector Class" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8}\1.0\FLAGS C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Installer [GitHub]\\x64" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Installer [GitHub]\\x64\\WinOpcIrmProtector.dll" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector.1 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8}\1.0\0 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5247F004-5DE0-4791-945A-BDD518260FC8}\1.0\0\win64 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinOpcIrmProtector.WinOpcIrmProtector\CurVer C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6FFEC3A-07F7-42D0-8829-B722F46DB533} C:\Windows\system32\regsvr32.exe N/A

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WinOpcIrmProtector.dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20231215-en

Max time kernel

449s

Max time network

1170s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\blbres - Copy.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\blbres - Copy.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

452s

Max time network

1175s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\bootux - Copy.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\bootux - Copy.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:40

Platform

win10v2004-20240226-en

Max time kernel

1793s

Max time network

1804s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\bootux.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\bootux.dll",#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3988 --field-trial-handle=2276,i,1205556100727695622,5044463180471657307,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2276,i,1205556100727695622,5044463180471657307,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 130.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 41.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 147.111.86.104.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.179.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 167.161.23.2.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 143.85.18.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 33.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 178.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 225.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 136.111.86.104.in-addr.arpa udp
US 8.8.8.8:53 249.110.86.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:47

Platform

win7-20240319-en

Max time kernel

1559s

Max time network

1570s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\trading_api64.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\trading_api64.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

450s

Max time network

1175s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WindowsInternal.Shell.CompUiActivation.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WindowsInternal.Shell.CompUiActivation.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp
US 8.8.8.8:53 79.239.69.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

1788s

Max time network

1802s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WindowsIoTCsp.dll",#1

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeManageVolumePrivilege N/A C:\Windows\System32\svchost.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WindowsIoTCsp.dll",#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3840 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k UnistackSvcGroup

Network

Country Destination Domain Proto
GB 142.250.178.10:443 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 175.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 167.161.23.2.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 136.111.86.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 160.111.86.104.in-addr.arpa udp
US 8.8.8.8:53 33.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

memory/4836-0-0x00000231A6AA0000-0x00000231A6AB0000-memory.dmp

memory/4836-16-0x00000231A6BA0000-0x00000231A6BB0000-memory.dmp

memory/4836-32-0x00000231AEF10000-0x00000231AEF11000-memory.dmp

memory/4836-34-0x00000231AEF40000-0x00000231AEF41000-memory.dmp

memory/4836-36-0x00000231AF050000-0x00000231AF051000-memory.dmp

memory/4836-35-0x00000231AEF40000-0x00000231AEF41000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:47

Platform

win10v2004-20240226-en

Max time kernel

449s

Max time network

1175s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\trading_api64.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\trading_api64.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 13:06

Platform

win10v2004-20240226-en

Max time kernel

452s

Max time network

1178s

Command Line

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\winethc.dll"

Signatures

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA}\1.0\0 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA}\1.0\HELPDIR C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA}\1.0\ = "WinInet Helper Class 1.0 Type Library" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA}\1.0\FLAGS C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA}\1.0\FLAGS\ = "0" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA}\1.0 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA}\1.0\0\win64 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Installer [GitHub]\\x64\\winethc.dll" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0049897D-5293-45BC-84AA-3CBE318812CA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Installer [GitHub]\\x64" C:\Windows\system32\regsvr32.exe N/A

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\winethc.dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 167.161.23.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20231215-en

Max time kernel

452s

Max time network

1176s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 748 created 3016 N/A C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G C:\Windows\system32\sihost.exe

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2072 set thread context of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G
PID 2072 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe

"C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe"

C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G

"C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G"

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 748 -ip 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 748 -ip 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 464

Network

Country Destination Domain Proto
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp

Files

memory/748-2-0x0000000000400000-0x000000000046D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G

MD5 3992f464696b0eeff236aef93b1fdbd5
SHA1 8dddabaea6b342efc4f5b244420a0af055ae691e
SHA256 0d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14
SHA512 27a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6

memory/748-6-0x0000000000400000-0x000000000046D000-memory.dmp

memory/748-7-0x0000000000400000-0x000000000046D000-memory.dmp

memory/748-8-0x0000000003150000-0x0000000003550000-memory.dmp

memory/748-10-0x0000000003150000-0x0000000003550000-memory.dmp

memory/748-9-0x0000000003150000-0x0000000003550000-memory.dmp

memory/748-12-0x0000000003150000-0x0000000003550000-memory.dmp

memory/748-11-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp

memory/748-14-0x00000000763B0000-0x00000000765C5000-memory.dmp

memory/4356-15-0x00000000007B0000-0x00000000007B9000-memory.dmp

memory/4356-18-0x0000000002590000-0x0000000002990000-memory.dmp

memory/4356-19-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp

memory/4356-21-0x0000000002590000-0x0000000002990000-memory.dmp

memory/4356-22-0x00000000763B0000-0x00000000765C5000-memory.dmp

memory/4356-23-0x0000000002590000-0x0000000002990000-memory.dmp

memory/748-24-0x0000000003150000-0x0000000003550000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

454s

Max time network

1177s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WindowsManagementServiceWinRt.ProxyStub.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WindowsManagementServiceWinRt.ProxyStub.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

459s

Max time network

1181s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WindowsUpdateElevatedInstaller.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WindowsUpdateElevatedInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WindowsUpdateElevatedInstaller.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 201.64.52.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:40

Platform

win10v2004-20240226-en

Max time kernel

1165s

Max time network

1168s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\opengl32 - Copy.dll",#1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\opengl32 - Copy.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 160.111.86.104.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:50

Platform

win7-20240221-en

Max time kernel

1808s

Max time network

1819s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\tradingnetworkingsockets.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\tradingnetworkingsockets.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win7-20240221-en

Max time kernel

36s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe"

Signatures

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe

"C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\Installer.exe"

C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G

"C:\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G"

Network

N/A

Files

memory/2268-0-0x0000000000140000-0x000000000014A000-memory.dmp

memory/2268-1-0x0000000000140000-0x000000000014A000-memory.dmp

memory/2268-2-0x0000000000140000-0x000000000014A000-memory.dmp

memory/2268-3-0x0000000000140000-0x000000000014A000-memory.dmp

\Users\Admin\AppData\Local\Temp\䜵䕸䙑兮㍆䕅硇湇G

MD5 3992f464696b0eeff236aef93b1fdbd5
SHA1 8dddabaea6b342efc4f5b244420a0af055ae691e
SHA256 0d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14
SHA512 27a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6

memory/2156-11-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2156-12-0x0000000000400000-0x000000000046D000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

456s

Max time network

1181s

Command Line

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WinMsoIrmProtector.dll"

Signatures

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971}\1.0 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector.1 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector\CurVer C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{706A79C0-1AC4-4E25-B311-93B643C1E499}\Programmable C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971}\1.0\ = "MsoIrmProtector 1.0 Type Library" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971}\1.0\HELPDIR C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Installer [GitHub]\\x64" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BA07C775-508D-420A-9640-23E7E6F65E5E} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\WinMsoIrmProtector.DLL\AppID = "{BA07C775-508D-420A-9640-23E7E6F65E5E}" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{706A79C0-1AC4-4E25-B311-93B643C1E499} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971}\1.0\FLAGS\ = "0" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Installer [GitHub]\\x64\\WinMsoIrmProtector.dll" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{706A79C0-1AC4-4E25-B311-93B643C1E499}\ProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{706A79C0-1AC4-4E25-B311-93B643C1E499}\TypeLib C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971}\1.0\FLAGS C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971}\1.0\0 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector.1\ = "WinMsoIrmProtector Class" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector.1\CLSID\ = "{706A79C0-1AC4-4E25-B311-93B643C1E499}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector\CLSID\ = "{706A79C0-1AC4-4E25-B311-93B643C1E499}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector\CurVer\ = "WinMsoIrmProtector.WinMsoIrmProtector.1" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{706A79C0-1AC4-4E25-B311-93B643C1E499}\VersionIndependentProgID C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BA07C775-508D-420A-9640-23E7E6F65E5E}\ = "WinMsoIrmProtector" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\WinMsoIrmProtector.DLL C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector.1\CLSID C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinMsoIrmProtector.WinMsoIrmProtector\ = "WinMsoIrmProtector Class" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B9932E7-611A-4C1E-BB26-2DC3B15DF971}\1.0\0\win64 C:\Windows\system32\regsvr32.exe N/A

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\WinMsoIrmProtector.dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:40

Platform

win7-20240319-en

Max time kernel

1563s

Max time network

1569s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\opengl32.dll",#1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2516 wrote to memory of 2920 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2516 wrote to memory of 2920 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2516 wrote to memory of 2920 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\opengl32.dll",#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2516 -s 56

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:40

Platform

win10v2004-20240226-en

Max time kernel

441s

Max time network

1170s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\opengl32.dll",#1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\opengl32.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 161.111.86.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 41.173.79.40.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:45

Platform

win7-20240221-en

Max time kernel

1561s

Max time network

1564s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\trading_api64 - Copy.dll",#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2852 wrote to memory of 2608 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2852 wrote to memory of 2608 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2852 wrote to memory of 2608 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\trading_api64 - Copy.dll",#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2852 -s 116

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

1789s

Max time network

1766s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\libs\xmllite.dll",#1

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeManageVolumePrivilege N/A C:\Windows\System32\svchost.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\libs\xmllite.dll",#1

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k UnistackSvcGroup

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 35.34.16.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 3.17.178.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 167.161.23.2.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 33.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

memory/4864-0-0x000001ED20A40000-0x000001ED20A50000-memory.dmp

memory/4864-16-0x000001ED20B40000-0x000001ED20B50000-memory.dmp

memory/4864-32-0x000001ED28E40000-0x000001ED28E41000-memory.dmp

memory/4864-34-0x000001ED28E70000-0x000001ED28E71000-memory.dmp

memory/4864-35-0x000001ED28E70000-0x000001ED28E71000-memory.dmp

memory/4864-36-0x000001ED28F80000-0x000001ED28F81000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

447s

Max time network

1171s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\3 - Copy.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\3 - Copy.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:40

Platform

win7-20240221-en

Max time kernel

1559s

Max time network

1566s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\opengl32 - Copy.dll",#1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 848 wrote to memory of 2320 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 848 wrote to memory of 2320 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 848 wrote to memory of 2320 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\opengl32 - Copy.dll",#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 848 -s 56

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 12:36

Platform

win10v2004-20240226-en

Max time kernel

442s

Max time network

1170s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\blbres.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\blbres.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-04-04 12:04

Reported

2024-04-04 13:06

Platform

win10v2004-20240226-en

Max time kernel

1512s

Max time network

1471s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\tradingnetworkingsockets.dll",#1

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeManageVolumePrivilege N/A C:\Windows\System32\svchost.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Installer [GitHub]\x64\tradingnetworkingsockets.dll",#1

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k UnistackSvcGroup

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 249.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 167.161.23.2.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 33.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 232.110.86.104.in-addr.arpa udp

Files

memory/4588-0-0x000002A5FFE20000-0x000002A5FFE30000-memory.dmp

memory/4588-16-0x000002A580340000-0x000002A580350000-memory.dmp

memory/4588-32-0x000002A5886B0000-0x000002A5886B1000-memory.dmp

memory/4588-34-0x000002A5886E0000-0x000002A5886E1000-memory.dmp

memory/4588-35-0x000002A5886E0000-0x000002A5886E1000-memory.dmp

memory/4588-36-0x000002A5887F0000-0x000002A5887F1000-memory.dmp