Overview
overview
7Static
static
7droidkit-en-setup.exe
windows7-x64
4droidkit-en-setup.exe
windows10-2004-x64
5$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...Vs.dll
windows7-x64
3$PLUGINSDI...Vs.dll
windows10-2004-x64
3$PLUGINSDI...ib.dll
windows7-x64
1$PLUGINSDI...ib.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...up.exe
windows7-x64
7$PLUGINSDI...up.exe
windows10-2004-x64
7$PLUGINSDI...00.dll
windows7-x64
1$PLUGINSDI...00.dll
windows10-2004-x64
1$PLUGINSDI...00.dll
windows7-x64
1$PLUGINSDI...00.dll
windows10-2004-x64
1$PLUGINSDIR/nsDui.dll
windows7-x64
3$PLUGINSDIR/nsDui.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...ll.exe
windows7-x64
4$PLUGINSDI...ll.exe
windows10-2004-x64
5$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ib.dll
windows7-x64
1$PLUGINSDI...ib.dll
windows10-2004-x64
3Analysis
-
max time kernel
1678s -
max time network
1179s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 08:49
Behavioral task
behavioral1
Sample
droidkit-en-setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
droidkit-en-setup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/CheckProVs.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/CheckProVs.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/GoogleTracingLib.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/GoogleTracingLib.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/dotNetFx45_Full_setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/dotNetFx45_Full_setup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/msvcp100.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/msvcp100.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/msvcr100.dll
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/msvcr100.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsDui.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsDui.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/uninstall.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/uninstall.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/GoogleTracingLib.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/GoogleTracingLib.dll
Resource
win10v2004-20240412-en
General
-
Target
$PLUGINSDIR/CheckProVs.dll
-
Size
7KB
-
MD5
62e85098ce43cb3d5c422e49390b7071
-
SHA1
df6722f155ce2a1379eff53a9ad1611ddecbb3bf
-
SHA256
ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2
-
SHA512
dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e
-
SSDEEP
96:iqCVh8iNqVgRudZczLiJp2tvgaJOnT/323x3XQUPVAm6yBBECtu7ZyvN:9IhJqUudZkLi+bOni3x3X3PVR6yBBfj
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3592 2612 WerFault.exe rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 4912 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 876 wrote to memory of 2612 876 rundll32.exe rundll32.exe PID 876 wrote to memory of 2612 876 rundll32.exe rundll32.exe PID 876 wrote to memory of 2612 876 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CheckProVs.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CheckProVs.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 6043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2612 -ip 26121⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4912-0-0x000002A2B6240000-0x000002A2B6250000-memory.dmpFilesize
64KB
-
memory/4912-16-0x000002A2B6340000-0x000002A2B6350000-memory.dmpFilesize
64KB
-
memory/4912-32-0x000002A2BE650000-0x000002A2BE651000-memory.dmpFilesize
4KB
-
memory/4912-34-0x000002A2BE680000-0x000002A2BE681000-memory.dmpFilesize
4KB
-
memory/4912-35-0x000002A2BE680000-0x000002A2BE681000-memory.dmpFilesize
4KB
-
memory/4912-36-0x000002A2BE790000-0x000002A2BE791000-memory.dmpFilesize
4KB