Overview
overview
10Static
static
10EDGY1.1.2.rar
windows7-x64
3EDGY1.1.2.rar
windows10-2004-x64
3EDGY/Edgy_...assets
windows7-x64
3EDGY/Edgy_...assets
windows10-2004-x64
3EDGY/Edgy_...source
windows7-x64
3EDGY/Edgy_...source
windows10-2004-x64
3EDGY/Edgy_...assets
windows7-x64
3EDGY/Edgy_...assets
windows10-2004-x64
3EDGY/Edgy_...s.ress
windows7-x64
3EDGY/Edgy_...s.ress
windows10-2004-x64
3EDGY/Edgy_...source
windows7-x64
3EDGY/Edgy_...source
windows10-2004-x64
3EDGY/Edgy_...assets
windows7-x64
3EDGY/Edgy_...assets
windows10-2004-x64
3EDGY/Edgy_...s.ress
windows7-x64
3EDGY/Edgy_...s.ress
windows10-2004-x64
3EDGY/Edgy_...assets
windows7-x64
3EDGY/Edgy_...assets
windows10-2004-x64
3EDGY/Edgy_...source
windows7-x64
3EDGY/Edgy_...source
windows10-2004-x64
3EDGY/MonoB...er.dll
windows7-x64
3EDGY/MonoB...er.dll
windows10-2004-x64
3EDGY/MonoB...gc.dll
windows7-x64
1EDGY/MonoB...gc.dll
windows10-2004-x64
1EDGY/MonoB...rowser
windows7-x64
3EDGY/MonoB...rowser
windows10-2004-x64
3EDGY/MonoB...tor.js
windows7-x64
3EDGY/MonoB...tor.js
windows10-2004-x64
3EDGY/MonoB...ne.xml
windows7-x64
1EDGY/MonoB...ne.xml
windows10-2004-x64
1EDGY/MonoB...gs.xml
windows7-x64
1EDGY/MonoB...gs.xml
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 16:19
Behavioral task
behavioral1
Sample
EDGY1.1.2.rar
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
EDGY1.1.2.rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
EDGY/Edgy_Data/sharedassets2.assets
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
EDGY/Edgy_Data/sharedassets2.assets
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
EDGY/Edgy_Data/sharedassets2.resource
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
EDGY/Edgy_Data/sharedassets2.resource
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
EDGY/Edgy_Data/sharedassets3.assets
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
EDGY/Edgy_Data/sharedassets3.assets
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
EDGY/Edgy_Data/sharedassets3.assets.ress
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
EDGY/Edgy_Data/sharedassets3.assets.ress
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
EDGY/Edgy_Data/sharedassets3.resource
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
EDGY/Edgy_Data/sharedassets3.resource
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
EDGY/Edgy_Data/sharedassets4.assets
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
EDGY/Edgy_Data/sharedassets4.assets
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
EDGY/Edgy_Data/sharedassets4.assets.ress
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
EDGY/Edgy_Data/sharedassets4.assets.ress
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
EDGY/Edgy_Data/sharedassets5.assets
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
EDGY/Edgy_Data/sharedassets5.assets
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
EDGY/Edgy_Data/sharedassets5.resource
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
EDGY/Edgy_Data/sharedassets5.resource
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
EDGY/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
EDGY/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
EDGY/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
EDGY/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
EDGY/MonoBleedingEdge/etc/mono/2.0/Browsers/Compat.browser
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
EDGY/MonoBleedingEdge/etc/mono/2.0/Browsers/Compat.browser
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
EDGY/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.js
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
EDGY/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
EDGY/MonoBleedingEdge/etc/mono/2.0/machine.xml
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
EDGY/MonoBleedingEdge/etc/mono/2.0/machine.xml
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
EDGY/MonoBleedingEdge/etc/mono/2.0/settings.xml
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
EDGY/MonoBleedingEdge/etc/mono/2.0/settings.xml
Resource
win10v2004-20240508-en
General
-
Target
EDGY/Edgy_Data/sharedassets2.resource
-
Size
10.1MB
-
MD5
5a1f9fdb125cc2fa2b983dd7d8f2ff34
-
SHA1
ba3327d97521c06af026d4ae981f17e0a5d28500
-
SHA256
504995f4151790c170deae998b7c8ebeaad0dc213a9a6242a6492901dccaf5dc
-
SHA512
8d6108cbe040aa49a91accec87ccf32bc1b481741616484ed6aba3508b12b24f0e1024a0cbe5468a2faf1d819a07e145be33aae6af5d09c193c5d9c49621f17f
-
SSDEEP
196608:C34Cpba+0NA3mhiYe0NBFdFPn0D8LPeKxSm1TLK+BRy:Rw0NvLNBRXp6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\resource_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\resource_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.resource\ = "resource_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\resource_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\resource_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.resource rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\resource_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\resource_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2284 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2284 AcroRd32.exe 2284 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2660 2032 cmd.exe 29 PID 2032 wrote to memory of 2660 2032 cmd.exe 29 PID 2032 wrote to memory of 2660 2032 cmd.exe 29 PID 2660 wrote to memory of 2284 2660 rundll32.exe 30 PID 2660 wrote to memory of 2284 2660 rundll32.exe 30 PID 2660 wrote to memory of 2284 2660 rundll32.exe 30 PID 2660 wrote to memory of 2284 2660 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\EDGY\Edgy_Data\sharedassets2.resource1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\EDGY\Edgy_Data\sharedassets2.resource2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\EDGY\Edgy_Data\sharedassets2.resource"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2284
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5883ac6be3250a226a1fe8d0e40ff29ff
SHA1be5e66087ff8fed9d38008df1b9fa841d8e78b95
SHA256ebf3c20bfc6d83c2b06f218f43491893c30578c79f48f5e766d765e5ff313341
SHA512d9979a7ff0ae2b6a66854f84affa64fd58450db24ad992bfe3927c6cc6fa818924ac84b3bb56f8722bc4844b8a2c76717c031412b3622a940a81e0ee9f362071