MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-15 01:16

Signatures

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libssl-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libssl-1_1-x64.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240611-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1528 wrote to memory of 1736	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1528 wrote to memory of 1736	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1528 wrote to memory of 1736	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1528 -s 80

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

55s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_1.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

90s

Max time network

56s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Detects Windows executables referencing non-Windows User-Agents

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects executables containing potential Windows Defender anti-emulation checks

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 3288 set thread context of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3288 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3288 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3288 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3288 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2096 wrote to memory of 3164	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2096 wrote to memory of 3164	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2096 wrote to memory of 3164	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2096 wrote to memory of 3164	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2096 wrote to memory of 3164	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3164 wrote to memory of 1952	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 3164 wrote to memory of 1952	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 3164 wrote to memory of 1952	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 1952 wrote to memory of 1804	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 1952 wrote to memory of 1804	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 1952 wrote to memory of 1804	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\DGIJEGHDAECA" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	feeldog.xyz	udp

Files

memory/3288-0-0x00007FF9F6060000-0x00007FF9F61D2000-memory.dmp

memory/3288-12-0x00007FF9F6078000-0x00007FF9F6079000-memory.dmp

memory/3288-13-0x00007FF9F6060000-0x00007FF9F61D2000-memory.dmp

memory/3288-14-0x00007FF9F6060000-0x00007FF9F61D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c02fa9c8

MD5	0fe42443907005df9867dd37536a4e6c
SHA1	4376698a223bf72d5988648552ce316ca81d194a
SHA256	586610bd6d117fa30bb08bcaf91fc5a0b98f89ced776d600c56a5bd02101ff94
SHA512	d22edf65277e53fec3866a7ded97d5ba31e88663831d543e337cdcc523571d6f3abd506c70bb0268791e2de09930cdd0a481d2c5e86c69b2c46a9b869cc13dbb

memory/2096-17-0x00007FFA14610000-0x00007FFA14805000-memory.dmp

memory/2096-20-0x0000000073EEE000-0x0000000073EF0000-memory.dmp

memory/2096-21-0x0000000073EE1000-0x0000000073EEF000-memory.dmp

memory/2096-24-0x0000000073EE1000-0x0000000073EEF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/3164-26-0x0000000000ED0000-0x000000000161C000-memory.dmp

memory/3164-28-0x00007FFA14610000-0x00007FFA14805000-memory.dmp

memory/3164-29-0x0000000000ED0000-0x000000000161C000-memory.dmp

memory/3164-31-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/3164-43-0x0000000000ED0000-0x000000000161C000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
BE	2.17.107.123:443	www.bing.com	tcp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	123.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	40.173.79.40.in-addr.arpa	udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:18

Platform

win7-20240221-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libssl-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libssl-1_1-x64.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240508-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

79s

Max time network

103s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Network.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Network.dll,#1

Network

Country	Destination	Domain	Proto
US	52.111.229.43:443		tcp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:18

Platform

win7-20231129-en

Max time kernel

119s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libcrypto-1_1-x64.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3028 wrote to memory of 1692	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 3028 wrote to memory of 1692	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 3028 wrote to memory of 1692	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libcrypto-1_1-x64.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3028 -s 104

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240226-en

Max time kernel

140s

Max time network

148s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	20.231.121.79:80		tcp
US	8.8.8.8:53	25.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	68.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	13.107.246.64:443		tcp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	192.142.123.92.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	210.143.182.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\api-ms-win-core-profile-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	20.231.121.79:80		tcp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	25.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	134.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.179.234:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	28.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:18

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libcrypto-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libcrypto-1_1-x64.dll,#1

Network

Country	Destination	Domain	Proto
US	52.111.229.43:443		tcp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240611-en

Max time kernel

117s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140.dll,#1

Network

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240221-en

Max time kernel

120s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1628 wrote to memory of 2228	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1628 wrote to memory of 2228	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1628 wrote to memory of 2228	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1628 wrote to memory of 2228	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1628 wrote to memory of 2228	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1628 wrote to memory of 2228	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1628 wrote to memory of 2228	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2228 wrote to memory of 1672	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2228 wrote to memory of 1672	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2228 wrote to memory of 1672	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2228 wrote to memory of 1672	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 220

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4004 -ip 4004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4004 -ip 4004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 540

Network

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

94s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	68.159.190.20.in-addr.arpa	udp
BE	2.17.107.98:443	www.bing.com	tcp
BE	2.17.107.98:443	www.bing.com	tcp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	98.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	18.24.18.2.in-addr.arpa	udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240220-en

Max time kernel

141s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Detects Windows executables referencing non-Windows User-Agents

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects executables containing potential Windows Defender anti-emulation checks

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2172 set thread context of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2172 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2172 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2172 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2172 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2172 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2156 wrote to memory of 2424	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2156 wrote to memory of 2424	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2156 wrote to memory of 2424	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2156 wrote to memory of 2424	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2156 wrote to memory of 2424	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2156 wrote to memory of 2424	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2424 wrote to memory of 2408	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2424 wrote to memory of 2408	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2424 wrote to memory of 2408	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2424 wrote to memory of 2408	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 148

Network

N/A

Files

memory/2172-0-0x000007FEF5600000-0x000007FEF5758000-memory.dmp

memory/2172-12-0x000007FEF5618000-0x000007FEF5619000-memory.dmp

memory/2172-13-0x000007FEF5600000-0x000007FEF5758000-memory.dmp

memory/2172-14-0x000007FEF5600000-0x000007FEF5758000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a3c79cf3

MD5	b66f9dad8c3785e36808e473e8344c4c
SHA1	3cfd2c49593814d539fbf0d2697a37b0eabac10f
SHA256	c8ea78c1ed06141697c20a039499b17d29a5f4bc4d852ab9030258012a79702a
SHA512	7db9146e37fd7e4738268adab811c6bbb6354b5c40971a28a048be37d13606870930aeacadc755ecbd0be46825f126ca0f75ab906fe031a965c13f2057bc2b70

memory/2156-17-0x0000000076E60000-0x0000000077009000-memory.dmp

memory/2156-20-0x000000007316E000-0x0000000073170000-memory.dmp

memory/2156-19-0x0000000073160000-0x00000000732D4000-memory.dmp

memory/2156-21-0x0000000073160000-0x00000000732D4000-memory.dmp

\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2424-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2424-26-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2156-28-0x0000000073160000-0x00000000732D4000-memory.dmp

memory/2424-30-0x0000000000B60000-0x00000000012AC000-memory.dmp

memory/2424-39-0x0000000000B60000-0x00000000012AC000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240221-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\hogg.pptx"

Signatures

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1652 wrote to memory of 2024	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe
PID 1652 wrote to memory of 2024	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe
PID 1652 wrote to memory of 2024	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe
PID 1652 wrote to memory of 2024	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\hogg.pptx"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/1652-0-0x000000002DA01000-0x000000002DA02000-memory.dmp

memory/1652-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1652-2-0x000000007219D000-0x00000000721A8000-memory.dmp

memory/1652-5-0x000000007219D000-0x00000000721A8000-memory.dmp

memory/1652-6-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1652-7-0x000000007219D000-0x00000000721A8000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:18

Platform

win7-20240611-en

Max time kernel

121s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\steam_api64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\steam_api64.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240611-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:18

Platform

win7-20240221-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

55s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Core.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240611-en

Max time kernel

120s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Network.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Network.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:18

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

148s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140_1.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3348,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:18

Platform

win10v2004-20240611-en

Max time kernel

93s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\steam_api64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\steam_api64.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	68.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
BE	2.17.107.105:443	www.bing.com	tcp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	105.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	21.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240611-en

Max time kernel

119s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2240 wrote to memory of 2164	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2240 wrote to memory of 2164	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2240 wrote to memory of 2164	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2240 -s 84

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2844 wrote to memory of 3188	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2844 wrote to memory of 3188	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2844 wrote to memory of 3188	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3188 -ip 3188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 604

Network

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:18

Platform

win7-20240221-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Core.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

55s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\hogg.pptx" /ou ""

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\hogg.pptx" /ou ""

Network

Files

memory/216-2-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

memory/216-3-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

memory/216-4-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

memory/216-1-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

memory/216-0-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

memory/216-5-0x00007FF98C30D000-0x00007FF98C30E000-memory.dmp

memory/216-7-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-6-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-8-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-9-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-10-0x00007FF949C10000-0x00007FF949C20000-memory.dmp

memory/216-11-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-13-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-12-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-14-0x00007FF949C10000-0x00007FF949C20000-memory.dmp

memory/216-15-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-16-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-18-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-20-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-23-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-22-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-21-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-19-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-17-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

memory/216-33-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

memory/216-34-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

memory/216-36-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

memory/216-35-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

memory/216-37-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-15 01:16

Reported

2024-06-15 01:19

Platform

win7-20240220-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140_1.dll,#1

Network

N/A

Files

N/A

Sample ID	240615-bmwjqaterf
Target	25cbba8cb4b96c8b9e6c8490c2460eb8fecb3b6dd4eb8fc2a06392cb018dda5b.zip
SHA256	25cbba8cb4b96c8b9e6c8490c2460eb8fecb3b6dd4eb8fc2a06392cb018dda5b
Tags	stealc vidar discovery spyware stealer

Malware Analysis Report

2024-09-11 16:51

Table of Contents