MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-15 12:11

Signatures

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240611-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2140 wrote to memory of 2188	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2140 wrote to memory of 2188	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2140 wrote to memory of 2188	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2140 -s 80

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240611-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

79s

Max time network

103s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Core.dll,#1

Network

Country	Destination	Domain	Proto
US	52.111.227.14:443		tcp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240508-en

Max time kernel

118s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1636 wrote to memory of 1012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1636 wrote to memory of 1012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1636 wrote to memory of 1012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1636 -s 80

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1200 wrote to memory of 4896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1200 wrote to memory of 4896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1200 wrote to memory of 4896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4896 -ip 4896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 604

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.72:443	www.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	75.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	72.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	89.43.201.23.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	121.150.79.40.in-addr.arpa	udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240220-en

Max time kernel

118s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240220-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2700 set thread context of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2700 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2700 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2700 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2700 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2700 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3012 wrote to memory of 2436	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3012 wrote to memory of 2436	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3012 wrote to memory of 2436	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3012 wrote to memory of 2436	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3012 wrote to memory of 2436	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3012 wrote to memory of 2436	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2436 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2436 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2436 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2436 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 148

Network

N/A

Files

memory/2700-0-0x000007FEF5A00000-0x000007FEF5B58000-memory.dmp

memory/2700-12-0x000007FEF5A18000-0x000007FEF5A19000-memory.dmp

memory/2700-13-0x000007FEF5A00000-0x000007FEF5B58000-memory.dmp

memory/2700-14-0x000007FEF5A00000-0x000007FEF5B58000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b5840da3

MD5	d5d9d12f28db992f0c9634684052db61
SHA1	2f1d1b6429c0f0dc01058f2985e9483ddc4d5cdf
SHA256	7023d34de582a1abf7e877b46eed1c6be79d73ebe7dd852c912ac2f8525ceb88
SHA512	aac5be0bbabb7a831ddf5a5464b540e19ab9d37a3caae0f7a37055d67a8b860b7c1e854b13868df946b3a317ded9eee105cef68cde4301ec67a21b7445d3876f

memory/3012-17-0x00000000772C0000-0x0000000077469000-memory.dmp

memory/3012-19-0x00000000735B0000-0x0000000073724000-memory.dmp

memory/3012-21-0x00000000735B0000-0x0000000073724000-memory.dmp

memory/3012-20-0x00000000735BE000-0x00000000735C0000-memory.dmp

\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2436-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2436-26-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/3012-28-0x00000000735B0000-0x0000000073724000-memory.dmp

memory/2436-30-0x0000000000670000-0x0000000000DBB000-memory.dmp

memory/2436-37-0x0000000000670000-0x0000000000DBB000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20231129-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\hogg.pptx"

Signatures

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2332 wrote to memory of 1672	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe
PID 2332 wrote to memory of 1672	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe
PID 2332 wrote to memory of 1672	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe
PID 2332 wrote to memory of 1672	N/A	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	C:\Windows\splwow64.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\hogg.pptx"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2332-0-0x000000002D9D1000-0x000000002D9D2000-memory.dmp

memory/2332-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2332-2-0x000000007259D000-0x00000000725A8000-memory.dmp

memory/2332-5-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2332-6-0x000000007259D000-0x00000000725A8000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_1.dll,#1

Network

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240611-en

Max time kernel

121s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2548 wrote to memory of 2724	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 2724	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 2724	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 2724	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 2724	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 2724	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 2724	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2724 wrote to memory of 2980	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2724 wrote to memory of 2980	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2724 wrote to memory of 2980	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2724 wrote to memory of 2980	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 224

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Network.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Network.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240611-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\steam_api64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\steam_api64.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240226-en

Max time kernel

134s

Max time network

167s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\steam_api64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\steam_api64.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	76.234.34.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	13.179.89.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4520 -ip 4520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4520 -ip 4520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3972,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	92.16.208.104.in-addr.arpa	udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

54s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\hogg.pptx" /ou ""

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A
N/A	N/A	C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE	N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\hogg.pptx" /ou ""

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

memory/2428-0-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

memory/2428-1-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

memory/2428-4-0x00007FFF16CED000-0x00007FFF16CEE000-memory.dmp

memory/2428-2-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

memory/2428-3-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

memory/2428-8-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-7-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-9-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-6-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

memory/2428-5-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-10-0x00007FFED4BE0000-0x00007FFED4BF0000-memory.dmp

memory/2428-13-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-14-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-17-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-16-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-15-0x00007FFED4BE0000-0x00007FFED4BF0000-memory.dmp

memory/2428-12-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-11-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-18-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-21-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-22-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-20-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-19-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

memory/2428-35-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

memory/2428-34-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

memory/2428-33-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

memory/2428-32-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

memory/2428-36-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libcrypto-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libcrypto-1_1-x64.dll,#1

Network

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240220-en

Max time kernel

119s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2184 wrote to memory of 1700	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2184 wrote to memory of 1700	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2184 wrote to memory of 1700	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140_1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2184 -s 80

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	99.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

104s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libssl-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libssl-1_1-x64.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	136.32.126.40.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	89.43.201.23.in-addr.arpa	udp
US	52.111.227.11:443		tcp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240221-en

Max time kernel

118s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140_1.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

149s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\vcruntime140.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4080,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8

Network

Country	Destination	Domain	Proto
NL	52.142.223.178:80		tcp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

52s

Max time network

58s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 3220 set thread context of 4892	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3220 wrote to memory of 4892	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3220 wrote to memory of 4892	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3220 wrote to memory of 4892	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3220 wrote to memory of 4892	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 4892 wrote to memory of 4844	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4892 wrote to memory of 4844	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4892 wrote to memory of 4844	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4892 wrote to memory of 4844	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4892 wrote to memory of 4844	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4844 wrote to memory of 4032	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 4844 wrote to memory of 4032	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 4844 wrote to memory of 4032	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 4032 wrote to memory of 2256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 4032 wrote to memory of 2256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 4032 wrote to memory of 2256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\JKKFIIEBKEGI" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	feeldog.xyz	udp

Files

memory/3220-0-0x00007FFC9B6E0000-0x00007FFC9B852000-memory.dmp

memory/3220-12-0x00007FFC9B6F8000-0x00007FFC9B6F9000-memory.dmp

memory/3220-13-0x00007FFC9B6E0000-0x00007FFC9B852000-memory.dmp

memory/3220-14-0x00007FFC9B6E0000-0x00007FFC9B852000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9fb9f845

MD5	8eff6e2e862c843def4de151d9f4c267
SHA1	f1ea836f9ea8ebfa44f5be8a6631ac5614069328
SHA256	64a7266ebca0cf2cc5fd67770f0b95414963fde9be1aa2fd90409cee35afdb7c
SHA512	67e93ecbca29307960e0c9de2ea6046204e3c51a0368cdbade7e79980d1884855e545faeb0524de7ee28885126b421254e7112c082a685c2fae68be78cfc7cc8

memory/4892-17-0x00007FFCB9D70000-0x00007FFCB9F65000-memory.dmp

memory/4892-20-0x0000000073F21000-0x0000000073F2F000-memory.dmp

memory/4892-19-0x0000000073F2E000-0x0000000073F30000-memory.dmp

memory/4892-24-0x0000000073F21000-0x0000000073F2F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/4844-26-0x00007FFCB9D70000-0x00007FFCB9F65000-memory.dmp

memory/4844-27-0x0000000000B40000-0x000000000128B000-memory.dmp

memory/4844-29-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4844-41-0x0000000000B40000-0x000000000128B000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240611-en

Max time kernel

120s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libcrypto-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libcrypto-1_1-x64.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240221-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240226-en

Max time kernel

132s

Max time network

171s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Network.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Network.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	68.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	172.217.169.74:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	74.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	13.179.89.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140.dll,#1

Network

Country	Destination	Domain	Proto
US	52.111.229.43:443		tcp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\msvcp140_1.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	72.32.126.40.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

55s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240611-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\Qt5Core.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-15 12:11

Reported

2024-06-15 12:14

Platform

win7-20240508-en

Max time kernel

119s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libssl-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_9898_P@$SW0rd~!!$\libssl-1_1-x64.dll,#1

Network

N/A

Files

N/A

Sample ID	240615-pcpkbazekh
Target	1f7553701ef80138d6fd387a8a5919bd34684600b8c81e45102d2a4c720786c1.zip
SHA256	1f7553701ef80138d6fd387a8a5919bd34684600b8c81e45102d2a4c720786c1
Tags	stealc vidar stealer discovery spyware

Malware Analysis Report

2024-09-11 16:48

Table of Contents