Overview
overview
10Static
static
3Uninstall-Node.js.exe
windows11-21h2-x64
10$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/app-64.7z
windows11-21h2-x64
3LICENSE.electron.txt
windows11-21h2-x64
3chrome_100...nt.pak
windows11-21h2-x64
3chrome_200...nt.pak
windows11-21h2-x64
3icudtl.dat
windows11-21h2-x64
3locales/am.pak
windows11-21h2-x64
3locales/ar.pak
windows11-21h2-x64
3locales/bg.pak
windows11-21h2-x64
3locales/bn.pak
windows11-21h2-x64
3locales/ca.pak
windows11-21h2-x64
3locales/cs.pak
windows11-21h2-x64
3locales/da.pak
windows11-21h2-x64
3locales/de.pak
windows11-21h2-x64
3locales/el.pak
windows11-21h2-x64
3locales/en-GB.pak
windows11-21h2-x64
3locales/en-US.pak
windows11-21h2-x64
3locales/es-419.pak
windows11-21h2-x64
3locales/es.pak
windows11-21h2-x64
3locales/et.pak
windows11-21h2-x64
3locales/fa.pak
windows11-21h2-x64
3locales/fi.pak
windows11-21h2-x64
3resources/...dex.js
windows11-21h2-x64
1resources/....2.bat
windows11-21h2-x64
7resources/elevate.exe
windows11-21h2-x64
1swiftshade...GL.dll
windows11-21h2-x64
1swiftshade...v2.dll
windows11-21h2-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
-
max time kernel
443s -
max time network
1179s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
08-04-2024 16:03
Static task
static1
Behavioral task
behavioral1
Sample
Uninstall-Node.js.exe
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240214-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app-64.7z
Resource
win11-20240214-en
Behavioral task
behavioral5
Sample
LICENSE.electron.txt
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
chrome_100_percent.pak
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
chrome_200_percent.pak
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
icudtl.dat
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
locales/am.pak
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
locales/ar.pak
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
locales/bg.pak
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
locales/bn.pak
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
locales/ca.pak
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
locales/cs.pak
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
locales/da.pak
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
locales/de.pak
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
locales/el.pak
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
locales/en-GB.pak
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
locales/en-US.pak
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
locales/es-419.pak
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
locales/es.pak
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
locales/et.pak
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
locales/fa.pak
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
locales/fi.pak
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
swiftshader/libEGL.dll
Resource
win11-20240214-en
Behavioral task
behavioral29
Sample
swiftshader/libGLESv2.dll
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win11-20240214-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240221-en
General
-
Target
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
-
Size
13KB
-
MD5
da0f40d84d72ae3e9324ad9a040a2e58
-
SHA1
4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
-
SHA256
818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
-
SHA512
30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
-
SSDEEP
384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
screenCapture_1.3.2.exepid Process 4996 screenCapture_1.3.2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.execsc.exedescription pid Process procid_target PID 2824 wrote to memory of 4108 2824 cmd.exe 79 PID 2824 wrote to memory of 4108 2824 cmd.exe 79 PID 2824 wrote to memory of 4108 2824 cmd.exe 79 PID 4108 wrote to memory of 2740 4108 csc.exe 80 PID 4108 wrote to memory of 2740 4108 csc.exe 80 PID 4108 wrote to memory of 2740 4108 csc.exe 80 PID 2824 wrote to memory of 4996 2824 cmd.exe 81 PID 2824 wrote to memory of 4996 2824 cmd.exe 81
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"2⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92F9.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC46762BFBA4074E78A1A22A33D0BE480.TMP"3⤵PID:2740
-
-
-
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exescreenCapture_1.3.2.exe2⤵
- Executes dropped EXE
PID:4996
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5436408bb2c890eb014ef0ffea1ecd49b
SHA1fa473aeb348fde0b1e9f3a23e59c6ac2e9ec5502
SHA2562fe222eca11bdf82d1096e35424f265f94425efc078c767a53ec92c29251966d
SHA512df47db759abeb97dc3824c15fba363c4f9cb3efbab616ee531863e9a35d546e77cadc54870e169dc322f30309be3d2be03dca17681a29c73fd5f8fc6d51dad4e
-
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
Filesize12KB
MD54d946514bd59cce0d763f29b60457d15
SHA1bd911152fbbc65dad7eaa78e7672df39c0f9b179
SHA256a715f533ad150618afc0c90bf6417b00586b3e740d56ba23a9c2567e263031db
SHA51220f7a279c8f23c5c3e2f5f6a8ffcbb16beb9235aa6f95e63e82012db0a6a38ea07fc8180e3f3f98de48a3cfbc232bbec6ca4a4401d920ae8ebd54ff3d98ecf98
-
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC46762BFBA4074E78A1A22A33D0BE480.TMP
Filesize1KB
MD5a6f2d21624678f54a2abed46e9f3ab17
SHA1a2a6f07684c79719007d434cbd1cd2164565734a
SHA256ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
SHA5120b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676