Overview
overview
10Static
static
3Node-js.exe
windows7-x64
7Node-js.exe
windows10-2004-x64
10$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Node-js.exe
windows7-x64
10Node-js.exe
windows10-2004-x64
10d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...dex.js
windows7-x64
1resources/...dex.js
windows10-2004-x64
1resources/....2.bat
windows7-x64
7resources/....2.bat
windows10-2004-x64
7resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3Analysis
-
max time kernel
139s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 12:04
Static task
static1
Behavioral task
behavioral1
Sample
Node-js.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
Node-js.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Node-js.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Node-js.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240319-en
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win7-20240220-en
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
swiftshader/libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral26
Sample
swiftshader/libGLESv2.dll
Resource
win7-20231129-en
Behavioral task
behavioral27
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240220-en
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
General
-
Target
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
-
Size
13KB
-
MD5
da0f40d84d72ae3e9324ad9a040a2e58
-
SHA1
4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
-
SHA256
818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
-
SHA512
30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
-
SSDEEP
384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
screenCapture_1.3.2.exepid Process 364 screenCapture_1.3.2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.execsc.exedescription pid Process procid_target PID 732 wrote to memory of 464 732 cmd.exe 89 PID 732 wrote to memory of 464 732 cmd.exe 89 PID 732 wrote to memory of 464 732 cmd.exe 89 PID 464 wrote to memory of 4608 464 csc.exe 91 PID 464 wrote to memory of 4608 464 csc.exe 91 PID 464 wrote to memory of 4608 464 csc.exe 91 PID 732 wrote to memory of 364 732 cmd.exe 93 PID 732 wrote to memory of 364 732 cmd.exe 93
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"2⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96D1.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC887F58CC71C147899F32B7B7DFC0349D.TMP"3⤵PID:4608
-
-
-
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exescreenCapture_1.3.2.exe2⤵
- Executes dropped EXE
PID:364
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59eca00e2e8bcf3addfb338b33f45eb62
SHA1eef50b9390906a982b45d40029192f6ab575a8a7
SHA256542dcebe95633721d7d3845362539ad5414ca95e77849255c17875fce166269c
SHA51204160ba6d1da7a5bc73a23c133dda67028d52a37bb136b9bf8fe29c9092e998407d067525bc0bba3c0e17dcd80bddf1df9f0bb277c4d2e6280d36838453716c9
-
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
Filesize12KB
MD596532e3fb8f05a5d441369bd7e47a557
SHA19a13fa21891c08e64e4d59e04c65a0eed3fabb99
SHA256fb3ac619c189f59238145b285c871fbc17aa07d85b547a768cb637358d80507c
SHA512ac36df3ad6de65657a72d42e9830e35434a9c89de3c2db12dcc52838a9e49f5660f0086596a6132e358297baf9fe99d120ebed2b2c67fb52bded91dc13e0144f
-
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC887F58CC71C147899F32B7B7DFC0349D.TMP
Filesize1KB
MD5a6f2d21624678f54a2abed46e9f3ab17
SHA1a2a6f07684c79719007d434cbd1cd2164565734a
SHA256ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
SHA5120b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676