Malware Analysis Report

2025-08-05 16:03

Sample ID 240606-1hxcwscd2t
Target 3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9
SHA256 3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9

Threat Level: Shows suspicious behavior

The file 3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9 was found to be: Shows suspicious behavior.

Malicious Activity Summary


Deletes itself

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-06 21:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-06 21:39

Reported

2024-06-06 21:42

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2132 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2132 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2132 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2132 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2836 wrote to memory of 2624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2836 wrote to memory of 2624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2836 wrote to memory of 2624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2836 wrote to memory of 2624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2132 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.exe
PID 2132 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.exe
PID 2132 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.exe
PID 2132 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe

"C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kw3lfnw0\kw3lfnw0.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2646.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc42E842DD689E40D3886E82D85F5CB91.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.exe" C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe

Network

N/A

Files

memory/2132-0-0x000000007448E000-0x000000007448F000-memory.dmp

memory/2132-1-0x0000000000E40000-0x0000000000E4A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kw3lfnw0\kw3lfnw0.cmdline

MD5 530b780bc8236254b4fc136197209970
SHA1 53a01f093296227c24d3258bda4019973d555a06
SHA256 9e30c5cda0cbc26763808dc3ccc172d03867b5614df8b6e71aeb051df6dfde4a
SHA512 a5ee5a4771feaf46abbb16ca416846bcfca9c34911bf1a3e935c995ecb910afb05fa09cd222dd68c5a69a93793ad81fdfc1326f60403e1df1a0270aabd0f6de0

memory/2132-7-0x0000000074480000-0x0000000074B6E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kw3lfnw0\kw3lfnw0.0.vb

MD5 78688011e7bc26f5b0ecf073d20301a9
SHA1 c6e054b132eb32b289cca8648d1e309ce55ebb82
SHA256 a2e10214d5f3563077f786ebd7fc986fba92129384e3635c833d8d29717aded5
SHA512 1b465f2774f386d0a0fd0477eca17748dea1ecd22185e7a1e5b59f7155e3e868d8671dfaae0bfa8aa26efa5690285c23fde44cad3d910c3558c5ba56251528c8

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 f77602eeb5dfd8d5331f89b51006957d
SHA1 1d3eeddd01c7c1acece87b7d4c2f3ae3ee15d49a
SHA256 5159b2149ef7241ac000f83f99020b1b74853f6ad93edfef4bd22341335d6f98
SHA512 99a847781f0450b99ff52492aed8c53e45248ff2b8a4a947833a12baebb1b6365506ab5afb2a133466cde7168e39cbfb196510b8b3e0670749301d686dd6b2ab

C:\Users\Admin\AppData\Local\Temp\vbc42E842DD689E40D3886E82D85F5CB91.TMP

MD5 e070c493e555643377b11293aa9cdb63
SHA1 94cde3f56c28d8a7d4b8bb7777cd8c47c68fd75d
SHA256 69d78095bbf3710a5336aff135e6eb5b0fb869bc41ac02aac70cf32a0ba220e8
SHA512 130b13522687c9b40301b7e429f462996aaf49a2454987f68013bf49e09b87c662e54605e8ebba67a64cee9ee49cdd1b8b476fd817b31fe93741e9547a8ae154

C:\Users\Admin\AppData\Local\Temp\RES2646.tmp

MD5 e716cd76568986447a329f6270644f78
SHA1 5f83ba715c595c1c3f080150273baf93907c6cd4
SHA256 a995ceb6ef26317c2a7cddbdbd02d8bc8bea9b1b3d9b66b66130d48c8e2f5e6c
SHA512 988191175eb436b69b3069ae8166569d4484dbdbfdf3cc9f328de2417dab368b35b2ea8c5bdbbac9cf143b58edb9096c657006759bfcc89497184e1d047978ee

C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.exe

MD5 556fd326ab1ddf6b754fd4f30c939200
SHA1 15fcf461c948163b5bb3b5d1bd139a954903a39f
SHA256 d70579eebdeadbdc2bc50900dbae304db35b3606adc4486f6d10bb1e6f077639
SHA512 1ca5380952a442dd4c907e812a4dbfafeee25095c196fb29485d73c1428f1bc27b18cc3ab257df6ca11d02eb58adf165a5ff41616daa9f837ae54d22c8d4b905

memory/2132-23-0x0000000074480000-0x0000000074B6E000-memory.dmp

memory/2792-24-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-06 21:39

Reported

2024-06-06 21:42

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp6F26.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp6F26.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4072 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4072 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4072 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2528 wrote to memory of 736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2528 wrote to memory of 736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2528 wrote to memory of 736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4072 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Users\Admin\AppData\Local\Temp\tmp6F26.tmp.exe
PID 4072 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Users\Admin\AppData\Local\Temp\tmp6F26.tmp.exe
PID 4072 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe C:\Users\Admin\AppData\Local\Temp\tmp6F26.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe

"C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1baipetg\1baipetg.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7109.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA8142FFB97741D0A1C586ACED66BF.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp6F26.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp6F26.tmp.exe" C:\Users\Admin\AppData\Local\Temp\3984bc3bf83506e6455119a8af0f04a91b1392a78fe3a39eabaa0c0230e6a9b9.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 187.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/4072-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

memory/4072-1-0x0000000000450000-0x000000000045A000-memory.dmp

memory/4072-2-0x0000000004E30000-0x0000000004ECC000-memory.dmp

memory/4072-8-0x0000000074EA0000-0x0000000075650000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1baipetg\1baipetg.cmdline

MD5 ef458671fa5e566944b2ea3f3b1347d0
SHA1 e6ff0d517190f04fbb8fb6cf085cc507ddc2bffd
SHA256 b9d7d12fe716785e323283e5682cc9d77ae4b39fe7dcc6f9da30ad9e7fb4530c
SHA512 e34702818b2493dc3a1c45a3a1e984db820ba94ef6c1274a6526a351a6ba9089a51ca13fb186d9e50331bcf129c4ed6fe4aa01c1ff8e272352ce382857ae5093

C:\Users\Admin\AppData\Local\Temp\1baipetg\1baipetg.0.vb

MD5 f824c9c4c48ca2f005ce27af956fc46c
SHA1 ecbada3f365d00194fc747ceeefc3da825e97170
SHA256 4bd6aaa2c69d828d945dc446b5d8e82be05b6ed896d986c258481b573888f908
SHA512 d8aefae799822510c00319694b8b714041382f8f7bbf852aa823adaa4ff73c0a9e1391723d49452bf124fd9d8d0a02fa744fcfd7b66944f735ea2ced06cc51e1

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 4929db1a65322d98bf9a3313e2af1f1e
SHA1 315f9fba4bc2197cc5d1db4c068b41fc448d61e4
SHA256 64dfb593d85f654bfac201fa054d25f94d551d369391a49669b9c08c20635db8
SHA512 0a005f396e4bd797731675b3c6750edb789a8b754ec518876451419312fdd4c5583a013b584de57f9eaa041831edbf48fb90b219bbbdbeacb0cb4b6c84a0d489

C:\Users\Admin\AppData\Local\Temp\vbcA8142FFB97741D0A1C586ACED66BF.TMP

MD5 2d013c9baa11ca394b168b5b13e265a2
SHA1 d6589eed0e77ecbe1c6de3a79c38963a1c23c9f7
SHA256 2a9c6bc492640f85eae610f162873b7601c694bee9847baf0b055776740acd78
SHA512 1a34e292cd828b3af263043fddc11d556bec2ccea0ab41b2f163474190833bc59b6f55b4e2b2598ed1385266f37e85ae79fe65e10416eb0af95f360ebaa9e7ac

C:\Users\Admin\AppData\Local\Temp\RES7109.tmp

MD5 c8c45181a0a64bfcca570280450a7d45
SHA1 713a472e32c6382285582c22482703b2401ffc98
SHA256 d3d20269f4ca643015b9eae1d3c8f9c0f4b38232ed57ab46b27e82fb5a0e7b4d
SHA512 d1b21a7ef6a9c9f26e88e1576c8f9c9606fbe6fe6de8ebc615e000458b5044dfede7b40081e561f1ad2a52df2c3619411cad9e61c8f9a27c83405b4dd33718d6

C:\Users\Admin\AppData\Local\Temp\tmp6F26.tmp.exe

MD5 f26c332232cc3ca8d191ab93058e2004
SHA1 467543a1714d004e4cd86c14b9892fe98510eff0
SHA256 bf970c2e4e86b9519be5d21cda9264e788c310e2dda963239dee82d1fead80f1
SHA512 0e8578b6e61c5ec06599529a872f94dd0f0ea0004b7d00a5f25c65ac6223ac105fd42a6f5540ee959f7570ec1b3312f8d907037e5570d6dbdb8061f067b25ff5

memory/1924-24-0x0000000074EA0000-0x0000000075650000-memory.dmp

memory/4072-25-0x0000000074EA0000-0x0000000075650000-memory.dmp

memory/1924-26-0x0000000000590000-0x000000000059A000-memory.dmp

memory/1924-27-0x00000000054D0000-0x0000000005A74000-memory.dmp

memory/1924-28-0x0000000004F20000-0x0000000004FB2000-memory.dmp

memory/1924-30-0x0000000074EA0000-0x0000000075650000-memory.dmp