Overview
overview
7Static
static
3....rar
windows7-x64
3....rar
windows10-2004-x64
3Catto Boi ...na.exe
windows7-x64
1Catto Boi ...na.exe
windows10-2004-x64
1Catto Boi ...le.dll
windows7-x64
1Catto Boi ...le.dll
windows10-2004-x64
1Catto Boi ...ev.dll
windows7-x64
1Catto Boi ...ev.dll
windows10-2004-x64
1Catto Boi ...ta.win
windows7-x64
3Catto Boi ...ta.win
windows10-2004-x64
3Catto Boi ...66.exe
windows7-x64
7Catto Boi ...66.exe
windows10-2004-x64
7Catto Boi ...ER.exe
windows7-x64
7Catto Boi ...ER.exe
windows10-2004-x64
7Catto Boi ...XT.exe
windows7-x64
7Catto Boi ...XT.exe
windows10-2004-x64
7Catto Boi ...am.exe
windows7-x64
7Catto Boi ...am.exe
windows10-2004-x64
7Catto Boi ...sh.exe
windows7-x64
7Catto Boi ...sh.exe
windows10-2004-x64
7Catto Boi ...ut.bat
windows7-x64
Catto Boi ...ut.bat
windows10-2004-x64
Catto Boi ...y!.txt
windows7-x64
1Catto Boi ...y!.txt
windows10-2004-x64
1Catto Boi ...o.hook
windows7-x64
3Catto Boi ...o.hook
windows10-2004-x64
3Catto Boi ...on.ico
windows7-x64
1Catto Boi ...on.ico
windows10-2004-x64
3Catto Boi ...n2.ico
windows7-x64
1Catto Boi ...n2.ico
windows10-2004-x64
3Catto Boi ...n3.ico
windows7-x64
1Catto Boi ...n3.ico
windows10-2004-x64
3Analysis
-
max time kernel
61s -
max time network
64s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 17:38
Static task
static1
Behavioral task
behavioral1
Sample
....rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
....rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Catto Boi The Quest for the Frozen Tuna (04)/Catto Boi Tuna.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Catto Boi The Quest for the Frozen Tuna (04)/Catto Boi Tuna.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Catto Boi The Quest for the Frozen Tuna (04)/DialogModule.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Catto Boi The Quest for the Frozen Tuna (04)/DialogModule.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Catto Boi The Quest for the Frozen Tuna (04)/GMS-WinDev.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Catto Boi The Quest for the Frozen Tuna (04)/GMS-WinDev.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data.win
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data.win
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/666.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/666.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/SUFFER.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/SUFFER.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/YOUARENEXT.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/YOUARENEXT.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/mouseSpam.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/mouseSpam.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/punish.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/punish.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/shut.bat
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/shut.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/hey!.txt
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/hey!.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/hooks/catto.hook
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/hooks/catto.hook
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/img/ico/icon.ico
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/img/ico/icon.ico
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/img/ico/icon2.ico
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/img/ico/icon2.ico
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/img/ico/icon3.ico
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Catto Boi The Quest for the Frozen Tuna (04)/data/img/ico/icon3.ico
Resource
win10v2004-20240508-en
Errors
General
-
Target
Catto Boi The Quest for the Frozen Tuna (04)/data/exe/shut.bat
-
Size
28B
-
MD5
15fdc55e9e8b1f0ac3f74108692baa36
-
SHA1
c5c6bcd7b0c2db0f5c5368c5f4dde13f7ced2e7c
-
SHA256
1c781f302420d20f326372c5c1c8adaa77a5e2c64fa83d0d59e10b4e25ad3b72
-
SHA512
f872613bd06bb710c4f9451996cfd49451bb7e359604c247085d0cfff6d0518181d367629762db458b236b1d12ed85f3367c914da512886e028f0502aa28e0c2
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2960 shutdown.exe Token: SeRemoteShutdownPrivilege 2960 shutdown.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2960 2268 cmd.exe 29 PID 2268 wrote to memory of 2960 2268 cmd.exe 29 PID 2268 wrote to memory of 2960 2268 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Catto Boi The Quest for the Frozen Tuna (04)\data\exe\shut.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\shutdown.exeshutdown /s /t 602⤵
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2508
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1536