Overview
overview
7Static
static
3Launcher.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows10-2004-x64
1Launcher.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
3ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
3locales/af.ps1
windows10-2004-x64
1locales/uk.ps1
windows10-2004-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows10-2004-x64
3vulkan-1.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$R0/Uninst...er.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:21
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Launcher.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral8
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
ffmpeg.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
libEGL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
libGLESv2.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral12
Sample
locales/af.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
locales/uk.ps1
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
resources/elevate.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
vk_swiftshader.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
vulkan-1.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
$R0/Uninstall Launcher.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240426-en
General
-
Target
locales/uk.ps1
-
Size
688KB
-
MD5
ee70e9f3557b9c8c67bfb8dfcb51384d
-
SHA1
fc4dfc35cde1a00f97eefe5e0a2b9b9c0149751e
-
SHA256
54324671a161f6d67c790bfd29349db2e2d21f5012dc97e891f8f5268bdf7e22
-
SHA512
f4e1da71cb0485851e8ebcd5d5cf971961737ad238353453db938b4a82a68a6bbaf3de7553f0ff1f915a0e6640a3e54f5368d9154b0a4ad38e439f5808c05b9f
-
SSDEEP
12288:wrccq9nty/KiDswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:HGX35EEK
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2496 powershell.exe 2496 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2496 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x424 0x2f41⤵PID:1992
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hld4np5o.0wm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2496-9-0x00000297F1840000-0x00000297F1862000-memory.dmpFilesize
136KB
-
memory/2496-12-0x00000297F1880000-0x00000297F1890000-memory.dmpFilesize
64KB
-
memory/2496-11-0x00000297F1880000-0x00000297F1890000-memory.dmpFilesize
64KB
-
memory/2496-10-0x00007FFF18D30000-0x00007FFF197F1000-memory.dmpFilesize
10.8MB
-
memory/2496-15-0x00007FFF18D30000-0x00007FFF197F1000-memory.dmpFilesize
10.8MB