MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-14 14:26

Signatures

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20240508-en

Max time kernel

117s

Max time network

118s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libcrypto-1_1-x64.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2988 wrote to memory of 3008	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2988 wrote to memory of 3008	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2988 wrote to memory of 3008	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libcrypto-1_1-x64.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2988 -s 104

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:29

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

58s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240611-en

Max time kernel

91s

Max time network

93s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\hogg.pptx" /ou ""

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\hogg.pptx" /ou ""

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	71.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	129.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	46.28.109.52.in-addr.arpa	udp
US	8.8.8.8:53	45.19.74.20.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
NL	23.62.61.72:443	www.bing.com	tcp
US	8.8.8.8:53	72.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	27.173.189.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	99.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp

Files

memory/3852-0-0x00007FFD99C10000-0x00007FFD99C20000-memory.dmp

memory/3852-2-0x00007FFD99C10000-0x00007FFD99C20000-memory.dmp

memory/3852-3-0x00007FFD99C10000-0x00007FFD99C20000-memory.dmp

memory/3852-1-0x00007FFD99C10000-0x00007FFD99C20000-memory.dmp

memory/3852-5-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-4-0x00007FFDD9C2D000-0x00007FFDD9C2E000-memory.dmp

memory/3852-6-0x00007FFD99C10000-0x00007FFD99C20000-memory.dmp

memory/3852-7-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-9-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-8-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-11-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-10-0x00007FFD978C0000-0x00007FFD978D0000-memory.dmp

memory/3852-12-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-13-0x00007FFD978C0000-0x00007FFD978D0000-memory.dmp

memory/3852-16-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-17-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-15-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-14-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

memory/3852-35-0x00007FFD99C10000-0x00007FFD99C20000-memory.dmp

memory/3852-36-0x00007FFD99C10000-0x00007FFD99C20000-memory.dmp

memory/3852-38-0x00007FFD99C10000-0x00007FFD99C20000-memory.dmp

memory/3852-37-0x00007FFD99C10000-0x00007FFD99C20000-memory.dmp

memory/3852-39-0x00007FFDD9B90000-0x00007FFDD9D85000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_1.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 3492 set thread context of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3492 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3492 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3492 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3492 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2012 wrote to memory of 2076	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2012 wrote to memory of 2076	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2012 wrote to memory of 2076	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2012 wrote to memory of 2076	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2012 wrote to memory of 2076	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2076 wrote to memory of 4396	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 4396	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 4396	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 4396 wrote to memory of 3256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 4396 wrote to memory of 3256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 4396 wrote to memory of 3256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4172,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\AKKEHIECFCAA" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	feeldog.xyz	udp

Files

memory/3492-0-0x00007FFA2F3A0000-0x00007FFA2F512000-memory.dmp

memory/3492-12-0x00007FFA2F3B8000-0x00007FFA2F3B9000-memory.dmp

memory/3492-13-0x00007FFA2F3A0000-0x00007FFA2F512000-memory.dmp

memory/3492-14-0x00007FFA2F3A0000-0x00007FFA2F512000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\95be399a

MD5	20d8e0aa2e8d53b53d91dec394988083
SHA1	8f1d9d0a16eed025c551cece2f1cf83bb9ba96a3
SHA256	e0368fc2b7355c94b653cd3282bd881dc19855f4ba9fa02ba34d921216a2bd7a
SHA512	5663bfd8f990902964716c2046ee58c6641bd5368795a21a9a24e85bbed5c48bc1960e28c9b96c04c0268fc00447b2120e8bd718a27d2ba9b9f95c94b123688c

memory/2012-17-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/2012-20-0x0000000073CA1000-0x0000000073CAF000-memory.dmp

memory/2012-19-0x0000000073CAE000-0x0000000073CB0000-memory.dmp

memory/2012-24-0x0000000073CA1000-0x0000000073CAF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2076-27-0x0000000000D60000-0x00000000014AB000-memory.dmp

memory/2076-28-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/2076-29-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2076-41-0x0000000000D60000-0x00000000014AB000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
NL	23.62.61.171:443	www.bing.com	tcp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	171.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	31.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	88.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	240.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53		udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:29

Platform

win7-20240508-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140_1.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1308,i,3144109701624127473,12586215149656995128,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.72:443	www.bing.com	tcp
US	8.8.8.8:53	198.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	18.53.126.40.in-addr.arpa	udp
US	8.8.8.8:53	72.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	32.251.17.2.in-addr.arpa	udp
NL	52.111.243.29:443		tcp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	98.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	240.197.17.2.in-addr.arpa	udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

54s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Core.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:29

Platform

win10v2004-20240226-en

Max time kernel

139s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libssl-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libssl-1_1-x64.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	129.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	82.177.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	164.189.21.2.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	31.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.179.234:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	234.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	26.73.42.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

148s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140_1.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240611-en

Max time kernel

89s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 944 -ip 944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 944 -ip 944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 552

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	131.253.33.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	71.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	237.33.253.131.in-addr.arpa	udp
US	8.8.8.8:53	205.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	99.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240611-en

Max time kernel

120s

Max time network

100s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
NL	23.62.61.72:443	www.bing.com	tcp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	72.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	32.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	98.251.17.2.in-addr.arpa	udp
US	52.111.227.11:443		tcp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:29

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\hogg.pptx"

Signatures

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2820 wrote to memory of 2260	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe
PID 2820 wrote to memory of 2260	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe
PID 2820 wrote to memory of 2260	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe
PID 2820 wrote to memory of 2260	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\hogg.pptx"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2820-0-0x000000002DEA1000-0x000000002DEA2000-memory.dmp

memory/2820-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2820-2-0x000000007258D000-0x0000000072598000-memory.dmp

memory/2820-5-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2820-6-0x000000007258D000-0x0000000072598000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20240611-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2464 wrote to memory of 2864	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2464 wrote to memory of 2864	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2464 wrote to memory of 2864	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2464 -s 80

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20231129-en

Max time kernel

120s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2360 wrote to memory of 2380	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2360 wrote to memory of 2380	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2360 wrote to memory of 2380	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2360 wrote to memory of 2380	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2360 wrote to memory of 2380	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2360 wrote to memory of 2380	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2360 wrote to memory of 2380	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2380 wrote to memory of 2368	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 2368	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 2368	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 2368	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 220

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:29

Platform

win10v2004-20240226-en

Max time kernel

135s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3696 wrote to memory of 3984	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3696 wrote to memory of 3984	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3696 wrote to memory of 3984	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3984 -ip 3984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	32.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	104.193.132.51.in-addr.arpa	udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:29

Platform

win7-20240611-en

Max time kernel

117s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libssl-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libssl-1_1-x64.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\steam_api64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\steam_api64.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4120,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	45.19.74.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	36.56.20.217.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	98.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	169.253.116.51.in-addr.arpa	udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libcrypto-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libcrypto-1_1-x64.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	131.253.33.237:443	g.bing.com	tcp
US	8.8.8.8:53	71.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	237.33.253.131.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	31.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	240.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	40.173.79.40.in-addr.arpa	udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20240508-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Network.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Network.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20240220-en

Max time kernel

149s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2860 set thread context of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2860 wrote to memory of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2860 wrote to memory of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2860 wrote to memory of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2860 wrote to memory of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2860 wrote to memory of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 1736 wrote to memory of 2220	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1736 wrote to memory of 2220	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1736 wrote to memory of 2220	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1736 wrote to memory of 2220	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1736 wrote to memory of 2220	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1736 wrote to memory of 2220	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2220 wrote to memory of 2324	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2220 wrote to memory of 2324	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2220 wrote to memory of 2324	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2220 wrote to memory of 2324	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 148

Network

N/A

Files

memory/2860-0-0x000007FEF55D0000-0x000007FEF5728000-memory.dmp

memory/2860-12-0x000007FEF55E8000-0x000007FEF55E9000-memory.dmp

memory/2860-13-0x000007FEF55D0000-0x000007FEF5728000-memory.dmp

memory/2860-14-0x000007FEF55D0000-0x000007FEF5728000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\987cdffd

MD5	2751da28871adb79eabf7f500ff418c3
SHA1	7dd38f4c0d91731446df578ee690dc4fd379e509
SHA256	ca26fe481db4eddf619c2ed98025366cf139ab4a8c59cb1d182c08a6779d8743
SHA512	54ec3f649d19dce3d760d62f31de25e4b7139f32593a9d04d0a0ca25e65facf4ae03be6f1719f397a0dc79691ff009717b1356657263e6864d596cb4740f9cf8

memory/1736-17-0x0000000076E50000-0x0000000076FF9000-memory.dmp

memory/1736-19-0x0000000073140000-0x00000000732B4000-memory.dmp

memory/1736-21-0x0000000073140000-0x00000000732B4000-memory.dmp

memory/1736-20-0x000000007314E000-0x0000000073150000-memory.dmp

\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2220-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2220-26-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1736-28-0x0000000073140000-0x00000000732B4000-memory.dmp

memory/2220-30-0x00000000005F0000-0x0000000000D3B000-memory.dmp

memory/2220-37-0x00000000005F0000-0x0000000000D3B000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20240221-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20240611-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Network.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Network.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:29

Platform

win7-20240611-en

Max time kernel

122s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20240221-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2804 wrote to memory of 2044	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2804 wrote to memory of 2044	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2804 wrote to memory of 2044	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2804 -s 80

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	32.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	98.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53		udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20231129-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Core.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-14 14:26

Reported

2024-06-14 14:28

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\steam_api64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\steam_api64.dll,#1

Network

N/A

Files

N/A

Sample ID	240614-rrwy2syanm
Target	#!~#0Pen_9898_P@$SW0rd~!!$.zip
SHA256	1f7553701ef80138d6fd387a8a5919bd34684600b8c81e45102d2a4c720786c1
Tags	stealc vidar discovery spyware stealer

Malware Analysis Report

2024-09-11 16:43

Table of Contents