Overview
overview
7Static
static
1PokeRandoZ..._0.zip
windows7-x64
1PokeRandoZ..._0.zip
windows10-2004-x64
1PokeRandoZX.jar
windows7-x64
1PokeRandoZX.jar
windows10-2004-x64
7launcher_MAC.command
windows7-x64
3launcher_MAC.command
windows10-2004-x64
3launcher_UNIX.sh
ubuntu-18.04-amd64
1launcher_UNIX.sh
debian-9-armhf
1launcher_UNIX.sh
debian-9-mips
1launcher_UNIX.sh
debian-9-mipsel
1launcher_WINDOWS.bat
windows7-x64
1launcher_WINDOWS.bat
windows10-2004-x64
7Analysis
-
max time kernel
122s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 12:52
Static task
static1
Behavioral task
behavioral1
Sample
PokeRandoZX-v4_6_0.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PokeRandoZX-v4_6_0.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
PokeRandoZX.jar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
PokeRandoZX.jar
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
launcher_MAC.command
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
launcher_MAC.command
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
launcher_UNIX.sh
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral8
Sample
launcher_UNIX.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral9
Sample
launcher_UNIX.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral10
Sample
launcher_UNIX.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral11
Sample
launcher_WINDOWS.bat
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
launcher_WINDOWS.bat
Resource
win10v2004-20240412-en
General
-
Target
launcher_WINDOWS.bat
-
Size
138B
-
MD5
dd444644a4794208a8e7cff6b0998256
-
SHA1
41af9fb8580f3fce9f2d9e2ef5e87d630a0f1ede
-
SHA256
a0f0e20e0be2cb4b14d65b6a2f44c7f79dd3ec72e26f85337f2bb4924b23da57
-
SHA512
32f904d84561e572fa916afbfcbbdbf3d0e11a1870fbde6b1f314035cd1c6ab53cfe39fd0da54bba86a2e7bef9ba546ae0f839b0413c9450629676c90cf6c1b6
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe -
Modifies registry class 2 IoCs
Processes:
java.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ java.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ java.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
java.exepid process 2484 java.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cmd.exejava.exedescription pid process target process PID 4200 wrote to memory of 2484 4200 cmd.exe java.exe PID 4200 wrote to memory of 2484 4200 cmd.exe java.exe PID 2484 wrote to memory of 4588 2484 java.exe icacls.exe PID 2484 wrote to memory of 4588 2484 java.exe icacls.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launcher_WINDOWS.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -Xmx4608M -jar PokeRandoZX.jar please-use-the-launcher2⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
PID:4588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5cc103e98405ace554fcd5f6271c9c574
SHA1fef22bf36468fbca5beede7fc6534c6f72387a9d
SHA256ee39f80a3f660ae3ffa61a3a1d8037146dfffec344cfab898aa620fca8fe7bd2
SHA512b586469c6df01119742f18344aa18a723f205ade2c685d1b2557430394626192fbcbda68be7e707d0fca8828e95ded38a6787213d22660a9fac7c3c36254cc3b
-
memory/2484-42-0x0000020F00280000-0x0000020F00290000-memory.dmpFilesize
64KB
-
memory/2484-18-0x0000020F73D60000-0x0000020F73D61000-memory.dmpFilesize
4KB
-
memory/2484-44-0x0000020F00000000-0x0000020F01000000-memory.dmpFilesize
16.0MB
-
memory/2484-45-0x0000020F002D0000-0x0000020F002E0000-memory.dmpFilesize
64KB
-
memory/2484-33-0x0000020F00000000-0x0000020F01000000-memory.dmpFilesize
16.0MB
-
memory/2484-34-0x0000020F73D60000-0x0000020F73D61000-memory.dmpFilesize
4KB
-
memory/2484-40-0x0000020F00000000-0x0000020F01000000-memory.dmpFilesize
16.0MB
-
memory/2484-4-0x0000020F00000000-0x0000020F01000000-memory.dmpFilesize
16.0MB
-
memory/2484-52-0x0000020F00000000-0x0000020F01000000-memory.dmpFilesize
16.0MB
-
memory/2484-17-0x0000020F73D60000-0x0000020F73D61000-memory.dmpFilesize
4KB
-
memory/2484-22-0x0000020F00000000-0x0000020F01000000-memory.dmpFilesize
16.0MB
-
memory/2484-47-0x0000020F002F0000-0x0000020F00300000-memory.dmpFilesize
64KB
-
memory/2484-46-0x0000020F002E0000-0x0000020F002F0000-memory.dmpFilesize
64KB
-
memory/2484-48-0x0000020F00000000-0x0000020F01000000-memory.dmpFilesize
16.0MB
-
memory/2484-49-0x0000020F00310000-0x0000020F00320000-memory.dmpFilesize
64KB
-
memory/2484-50-0x0000020F00320000-0x0000020F00330000-memory.dmpFilesize
64KB
-
memory/2484-51-0x0000020F00000000-0x0000020F01000000-memory.dmpFilesize
16.0MB
-
memory/2484-43-0x0000020F00300000-0x0000020F00310000-memory.dmpFilesize
64KB