Overview
overview
10Static
static
9by Cel3ry V2.2.1.zip
windows10-2004-x64
1Celery.rar
windows10-2004-x64
3Celery/Celery V2.exe
windows10-2004-x64
10$INTERNET_...essive
windows10-2004-x64
1$INTERNET_CACHE/Autos
windows10-2004-x64
1$INTERNET_...rettes
windows10-2004-x64
1$INTERNET_...lexity
windows10-2004-x64
1$INTERNET_CACHE/Even
windows10-2004-x64
1$INTERNET_...Harold
windows10-2004-x64
1$INTERNET_CACHE/He
windows10-2004-x64
1$INTERNET_CACHE/Herb
windows10-2004-x64
1$INTERNET_...ndiana
windows10-2004-x64
1$INTERNET_CACHE/Kent
windows10-2004-x64
1$INTERNET_...Option
windows10-2004-x64
1$INTERNET_...anizer
windows10-2004-x64
1$INTERNET_...Outlet
windows10-2004-x64
1$INTERNET_...minder
windows10-2004-x64
1$INTERNET_...quests
windows10-2004-x64
1$INTERNET_...mebody
windows10-2004-x64
1$INTERNET_...Suited
windows10-2004-x64
1$INTERNET_...Temple
windows10-2004-x64
1$INTERNET_...lletin
windows10-2004-x64
1Celery/dll...32.dll
windows10-2004-x64
1Celery/dll...32.lib
windows10-2004-x64
3Celery/dll...SE.txt
windows10-2004-x64
1Celery/dll...wp.dll
windows10-2004-x64
1Celery/dll...uwpver
windows10-2004-x64
1Celery/dll/uwpoff.bin
windows10-2004-x64
3Celery/dll/uwpoffver
windows10-2004-x64
1Celery/dll...on.txt
windows10-2004-x64
1Celery/scr...ts.dll
windows10-2004-x64
1README.txt
windows10-2004-x64
1Analysis
-
max time kernel
1791s -
max time network
1802s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 18:07
Behavioral task
behavioral1
Sample
by Cel3ry V2.2.1.zip
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
Celery.rar
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Celery/Celery V2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
$INTERNET_CACHE/Aggressive
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$INTERNET_CACHE/Autos
Resource
win10v2004-20240412-en
Behavioral task
behavioral6
Sample
$INTERNET_CACHE/Cigarettes
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
$INTERNET_CACHE/Complexity
Resource
win10v2004-20240412-en
Behavioral task
behavioral8
Sample
$INTERNET_CACHE/Even
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
$INTERNET_CACHE/Harold
Resource
win10v2004-20240412-en
Behavioral task
behavioral10
Sample
$INTERNET_CACHE/He
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$INTERNET_CACHE/Herb
Resource
win10v2004-20240412-en
Behavioral task
behavioral12
Sample
$INTERNET_CACHE/Indiana
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
$INTERNET_CACHE/Kent
Resource
win10v2004-20240412-en
Behavioral task
behavioral14
Sample
$INTERNET_CACHE/Option
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
$INTERNET_CACHE/Organizer
Resource
win10v2004-20240412-en
Behavioral task
behavioral16
Sample
$INTERNET_CACHE/Outlet
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
$INTERNET_CACHE/Reminder
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
$INTERNET_CACHE/Requests
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
$INTERNET_CACHE/Somebody
Resource
win10v2004-20240412-en
Behavioral task
behavioral20
Sample
$INTERNET_CACHE/Suited
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
$INTERNET_CACHE/Temple
Resource
win10v2004-20240412-en
Behavioral task
behavioral22
Sample
$INTERNET_CACHE/Vbulletin
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
Celery/dll/VMProtectSDK32.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral24
Sample
Celery/dll/VMProtectSDK32.lib
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Celery/dll/autoexec/HOW_TO_USE.txt
Resource
win10v2004-20240412-en
Behavioral task
behavioral26
Sample
Celery/dll/celeryuwp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Celery/dll/celeryuwpver
Resource
win10v2004-20240412-en
Behavioral task
behavioral28
Sample
Celery/dll/uwpoff.bin
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
Celery/dll/uwpoffver
Resource
win10v2004-20240412-en
Behavioral task
behavioral30
Sample
Celery/dll/uwpversion.txt
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
Celery/scripts/scripts.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral32
Sample
README.txt
Resource
win10v2004-20240412-en
General
-
Target
Celery/dll/celeryuwp.dll
-
Size
4.2MB
-
MD5
b0f566fc20de341e2848a489f69a4e48
-
SHA1
7a81ab4c68ddeb1e0a83c37e17286ae53e29c334
-
SHA256
5223f453b44be5d13f5f249f1f23b020b75c7e237c23712d97813c430015afc6
-
SHA512
4ba8394bede49de1dd1ad98afa59e0546b5118cf6b75dcf2cc83f00fde88bda0d659944c3324d19960d935d9e29e69f8b9b08fa5d5db7f71506e13471bbcb75f
-
SSDEEP
49152:LikvPpFjV8b8bhnNcZXGDQc6jg8mHdnYvLyv5ttr24Y4AxYWAF7yWGxmR/qSDQey:0ZXGU7k8Ol5/24PqNmOQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1632 wrote to memory of 2272 1632 rundll32.exe rundll32.exe PID 1632 wrote to memory of 2272 1632 rundll32.exe rundll32.exe PID 1632 wrote to memory of 2272 1632 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Celery\dll\celeryuwp.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Celery\dll\celeryuwp.dll,#12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵