1d8c80f52a16666330f204788cc9eb42d0439a4ff81ae39ffdf3ad3103751366 | Triage

Submit
Reports

Overview

overview

Static

static

Protect.rar

windows7-x64

3

Protect.rar

windows10-2004-x64

3

Protect/Co...on.dll

windows7-x64

1

Protect/Co...on.dll

windows10-2004-x64

1

Protect/Core.dll

windows7-x64

1

Protect/Core.dll

windows10-2004-x64

1

Protect/Co...config

windows7-x64

3

Protect/Co...config

windows10-2004-x64

3

Protect/Custom.txt

windows7-x64

1

Protect/Custom.txt

windows10-2004-x64

1

Protect/Guna.UI2.dll

windows7-x64

1

Protect/Guna.UI2.dll

windows10-2004-x64

1

Protect/Hardening.dll

windows7-x64

1

Protect/Hardening.dll

windows10-2004-x64

1

Protect/Ha...config

windows7-x64

3

Protect/Ha...config

windows10-2004-x64

3

Protect/Runtime.dll

windows7-x64

1

Protect/Runtime.dll

windows10-2004-x64

1

Protect/SE...config

windows7-x64

3

Protect/SE...config

windows10-2004-x64

3

Protect/Saved.txt

windows7-x64

1

Protect/Saved.txt

windows10-2004-x64

1

Protect/VMUtils.dll

windows7-x64

1

Protect/VMUtils.dll

windows10-2004-x64

1

Protect/Webhook.txt

windows7-x64

1

Protect/Webhook.txt

windows10-2004-x64

1

Protect/bi...IT.exe

windows7-x64

Protect/bi...IT.exe

windows10-2004-x64

Protect/dnlib.dll

windows7-x64

1

Protect/dnlib.dll

windows10-2004-x64

1

Protect/dnlib.xml

windows7-x64

1

Protect/dnlib.xml

windows10-2004-x64

1

Analysis

max time kernel
232s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 15:33

Sharing

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

Protect.rar

Resource

win7-20240419-en

windows7-x64

8 signatures

300 seconds

Behavioral task

behavioral2

Sample

Protect.rar

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral3

Sample

Protect/CodeEncryption.dll

Resource

win7-20231129-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral4

Sample

Protect/CodeEncryption.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral5

Sample

Protect/Core.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral6

Sample

Protect/Core.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral7

Sample

Protect/Core.dll.config

Resource

win7-20240508-en

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral8

Sample

Protect/Core.dll.config

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral9

Sample

Protect/Custom.txt

Resource

win7-20240508-en

windows7-x64

1 signatures

300 seconds

Behavioral task

behavioral10

Sample

Protect/Custom.txt

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral11

Sample

Protect/Guna.UI2.dll

Resource

win7-20240419-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral12

Sample

Protect/Guna.UI2.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral13

Sample

Protect/Hardening.dll

Resource

win7-20240220-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral14

Sample

Protect/Hardening.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral15

Sample

Protect/Hardening.dll.config

Resource

win7-20240215-en

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral16

Sample

Protect/Hardening.dll.config

Resource

win10v2004-20240226-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral17

Sample

Protect/Runtime.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral18

Sample

Protect/Runtime.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral19

Sample

Protect/SECURE BYTE GUI.exe.config

Resource

win7-20231129-en

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral20

Sample

Protect/SECURE BYTE GUI.exe.config

Resource

win10v2004-20240426-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral21

Sample

Protect/Saved.txt

Resource

win7-20240508-en

windows7-x64

1 signatures

300 seconds

Behavioral task

behavioral22

Sample

Protect/Saved.txt

Resource

win10v2004-20240508-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral23

Sample

Protect/VMUtils.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral24

Sample

Protect/VMUtils.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral25

Sample

Protect/Webhook.txt

Resource

win7-20240215-en

windows7-x64

1 signatures

300 seconds

Behavioral task

behavioral26

Sample

Protect/Webhook.txt

Resource

win10v2004-20240508-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral27

Sample

Protect/bimno1-JIT.exe

Resource

win7-20240508-en

agenttesla evasion keylogger spyware stealer trojan

windows7-x64

11 signatures

300 seconds

Behavioral task

behavioral28

Sample

Protect/bimno1-JIT.exe

Resource

win10v2004-20240426-en

agenttesla evasion keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

300 seconds

Behavioral task

behavioral29

Sample

Protect/dnlib.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral30

Sample

Protect/dnlib.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral31

Sample

Protect/dnlib.xml

Resource

win7-20240221-en

windows7-x64

4 signatures

300 seconds

Behavioral task

behavioral32

Sample

Protect/dnlib.xml

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

300 seconds

Report Analysis Logs

General

Target

Protect/dnlib.xml
Size

1.8MB
MD5

4f66f6d14a67bbd0f70012557d88d17b
SHA1

d378a9d3fefa6b152c571471c0f137f10fff3151
SHA256

f453807c0866bdb424541c9297a4c55107143c0103cb84f23d070044f62b7273
SHA512

4ee56fd74dbbcaf4ba0ba41a10c4c88bde0d12b2a01afab71017acc1b604658ed9f64b03a0a0876d295c3591ff000f0fd75cdf622612027bd8860d811e6e7b34
SSDEEP

6144:VTA+Hp1CIPAqPFgrOLkOXhR+y+cNUaOtCW5n:dp1CIPAqPFgrO7XhR+y+cNUaOtCW5n

Score

1^/10

Malware Config

Signatures

Processes

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Protect\dnlib.xml"
1⤵
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-0-0x00007FFAC90D0000-0x00007FFAC90E0000-memory.dmp

Filesize
64KB

Download
memory/2748-1-0x00007FFB090ED000-0x00007FFB090EE000-memory.dmp

Filesize
4KB

Download
memory/2748-2-0x00007FFB09050000-0x00007FFB09245000-memory.dmp

Filesize
2.0MB

Download
memory/2748-3-0x00007FFB09050000-0x00007FFB09245000-memory.dmp

Filesize
2.0MB

Download

© 2018-2024

Terms | Privacy