Overview
overview
7Static
static
3de10aa6f3c...9a.exe
windows7-x64
7de10aa6f3c...9a.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1ShaderifyBeta.exe
windows7-x64
7ShaderifyBeta.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/app.js
windows7-x64
3resources/app.js
windows10-2004-x64
3resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
- max time kernel
123s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
14/06/2024, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
de10aa6f3cf0d066b00b9331b98de872704acb3f5bc29c19002b3aacc392a29a.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
de10aa6f3cf0d066b00b9331b98de872704acb3f5bc29c19002b3aacc392a29a.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ShaderifyBeta.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
ShaderifyBeta.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.js
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.js
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/elevate.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/elevate.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
swiftshader/libEGL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral23
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral25
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target ShaderifyBeta.exe
- Size 120.4MB
- Sample240614-chek3s1erc
- SHA256 d898a8bd9a2bb747478d8abc4f10352ece031f99781a6d0f97b4782619982325
- MD5 9c094a8f32f41493c050557ead046aa9
- SHA1 c572b2dc97a790a24dc584417a83062da530304c
- SHA512 f8f01c114e48cbe47b197960b87b221d808a438635705a710b671ae3c5f3739efb41e0d5cc1531ec1049ea638f049bee8214714883752b8c1cb80d426088355b
- SSDEEP 1572864:o1f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:Nasulbg8yTnbEOz
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation ShaderifyBeta.exe - Loads dropped DLL 1 IoCs
pid Process 1676 ShaderifyBeta.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ipinfo.io 3 api.ipify.org 5 api.ipify.org 7 ipinfo.io - An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
pid Process 2580 cmd.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2516 tasklist.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2556 powershell.exe 2732 ShaderifyBeta.exe 1676 ShaderifyBeta.exe 1676 ShaderifyBeta.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2516 tasklist.exe Token: SeDebugPrivilege 2556 powershell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1628 1676 ShaderifyBeta.exe 28 PID 1676 wrote to memory of 1628 1676 ShaderifyBeta.exe 28 PID 1676 wrote to memory of 1628 1676 ShaderifyBeta.exe 28 PID 1628 wrote to memory of 2516 1628 cmd.exe 30 PID 1628 wrote to memory of 2516 1628 cmd.exe 30 PID 1628 wrote to memory of 2516 1628 cmd.exe 30 PID 1676 wrote to memory of 2580 1676 ShaderifyBeta.exe 32 PID 1676 wrote to memory of 2580 1676 ShaderifyBeta.exe 32 PID 1676 wrote to memory of 2580 1676 ShaderifyBeta.exe 32 PID 2580 wrote to memory of 2556 2580 cmd.exe 34 PID 2580 wrote to memory of 2556 2580 cmd.exe 34 PID 2580 wrote to memory of 2556 2580 cmd.exe 34 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2456 1676 ShaderifyBeta.exe 35 PID 1676 wrote to memory of 2732 1676 ShaderifyBeta.exe 36 PID 1676 wrote to memory of 2732 1676 ShaderifyBeta.exe 36 PID 1676 wrote to memory of 2732 1676 ShaderifyBeta.exe 36 PID 1676 wrote to memory of 840 1676 ShaderifyBeta.exe 37 PID 1676 wrote to memory of 840 1676 ShaderifyBeta.exe 37 PID 1676 wrote to memory of 840 1676 ShaderifyBeta.exe 37 PID 1676 wrote to memory of 840 1676 ShaderifyBeta.exe 37 PID 1676 wrote to memory of 840 1676 ShaderifyBeta.exe 37 PID 1676 wrote to memory of 840 1676 ShaderifyBeta.exe 37 PID 1676 wrote to memory of 840 1676 ShaderifyBeta.exe 37 PID 1676 wrote to memory of 840 1676 ShaderifyBeta.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,45,204,86,131,46,228,91,64,175,15,151,62,153,122,62,62,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,77,110,209,252,182,198,4,154,87,197,245,53,39,231,107,249,184,40,45,0,24,246,100,84,235,238,233,27,220,83,224,233,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,47,182,225,224,33,237,235,155,138,205,164,0,36,33,60,9,124,133,34,107,237,168,140,220,214,72,196,158,196,244,252,84,48,0,0,0,155,228,31,126,164,117,220,177,152,185,34,62,167,29,118,179,201,227,248,185,27,246,61,182,203,213,78,174,198,74,133,155,168,33,66,62,109,87,3,236,185,37,40,72,168,188,167,79,64,0,0,0,178,135,223,223,37,55,116,207,2,9,203,90,28,70,245,181,242,122,248,118,250,46,135,145,225,62,172,150,235,62,98,193,245,110,180,78,25,70,188,173,61,53,72,251,107,170,103,143,67,201,159,146,248,249,210,95,246,240,89,186,32,192,16,76), $null, 'CurrentUser')"2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,45,204,86,131,46,228,91,64,175,15,151,62,153,122,62,62,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,77,110,209,252,182,198,4,154,87,197,245,53,39,231,107,249,184,40,45,0,24,246,100,84,235,238,233,27,220,83,224,233,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,47,182,225,224,33,237,235,155,138,205,164,0,36,33,60,9,124,133,34,107,237,168,140,220,214,72,196,158,196,244,252,84,48,0,0,0,155,228,31,126,164,117,220,177,152,185,34,62,167,29,118,179,201,227,248,185,27,246,61,182,203,213,78,174,198,74,133,155,168,33,66,62,109,87,3,236,185,37,40,72,168,188,167,79,64,0,0,0,178,135,223,223,37,55,116,207,2,9,203,90,28,70,245,181,242,122,248,118,250,46,135,145,225,62,172,150,235,62,98,193,245,110,180,78,25,70,188,173,61,53,72,251,107,170,103,143,67,201,159,146,248,249,210,95,246,240,89,186,32,192,16,76), $null, 'CurrentUser')3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
-
C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1128,11662187840230557692,11374387260859709412,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1132 /prefetch:22⤵PID:2456
-
-
C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1128,11662187840230557692,11374387260859709412,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=812 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1128,11662187840230557692,11374387260859709412,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1480 /prefetch:22⤵PID:840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Admincookies.zip
- Size 22B
- SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
- MD5 76cdb2bad9582d23c1f6f4d868218d6c
- SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
- SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\cd93b765-ba9c-4e11-b417-ce15ab310cbd.tmp.node
- Size 1.4MB
- SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
- MD5 56192831a7f808874207ba593f464415
- SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
- SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33
- SSDEEP 24576:HczztZ12vAxqcdzoAyv+liT0eYiYJ869tUb/K:8zztZ12vodwW0T0NZJftm
- MD5 SHA1 SHA512 SSDEEP