MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-15 17:49

Signatures

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240611-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\url_launcher_windows_plugin.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2968 wrote to memory of 2372	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2968 wrote to memory of 2372	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2968 wrote to memory of 2372	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\url_launcher_windows_plugin.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2968 -s 224

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

58s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Network

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240508-en

Max time kernel

118s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\msvcp140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2088 wrote to memory of 1488	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2088 wrote to memory of 1488	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2088 wrote to memory of 1488	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\msvcp140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2088 -s 80

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240221-en

Max time kernel

117s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\tray_manager_plugin.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2200 wrote to memory of 1612	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2200 wrote to memory of 1612	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2200 wrote to memory of 1612	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\tray_manager_plugin.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2200 -s 224

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\tray_manager_plugin.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\tray_manager_plugin.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
NL	23.62.61.160:443	www.bing.com	tcp
US	8.8.8.8:53	160.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	131.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240508-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	71.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	131.83.221.88.in-addr.arpa	udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240508-en

Max time kernel

117s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1776 wrote to memory of 2128	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1776 wrote to memory of 2128	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1776 wrote to memory of 2128	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1776 wrote to memory of 2128	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1776 wrote to memory of 2128	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1776 wrote to memory of 2128	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1776 wrote to memory of 2128	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2128 wrote to memory of 2224	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2128 wrote to memory of 2224	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2128 wrote to memory of 2224	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2128 wrote to memory of 2224	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 220

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

55s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 744 wrote to memory of 5056	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 744 wrote to memory of 5056	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 744 wrote to memory of 5056	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5056 -ip 5056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 604

Network

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240221-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4376 -ip 4376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4376 -ip 4376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 580

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.129:443	www.bing.com	tcp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	129.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	200.64.52.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	136.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	131.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	200.64.52.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240508-en

Max time kernel

121s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_windows.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2444 wrote to memory of 1948	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2444 wrote to memory of 1948	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2444 wrote to memory of 1948	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_windows.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2444 -s 204

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240508-en

Max time kernel

120s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2252 wrote to memory of 2652	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2252 wrote to memory of 2652	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2252 wrote to memory of 2652	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2252 -s 80

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240226-en

Max time kernel

157s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-string-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-string-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	76.234.34.23.in-addr.arpa	udp
GB	142.250.187.234:443		tcp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	13.107.246.64:443		tcp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	129.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	114.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240611-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\windows_single_instance_plugin.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2440 wrote to memory of 1184	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2440 wrote to memory of 1184	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2440 wrote to memory of 1184	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\windows_single_instance_plugin.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2440 -s 204

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240508-en

Max time kernel

78s

Max time network

106s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4372 set thread context of 4920	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4372 wrote to memory of 4920	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 4372 wrote to memory of 4920	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 4372 wrote to memory of 4920	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 4372 wrote to memory of 4920	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 4920 wrote to memory of 3704	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4920 wrote to memory of 3704	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4920 wrote to memory of 3704	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4920 wrote to memory of 3704	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4920 wrote to memory of 3704	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3704 wrote to memory of 1936	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 3704 wrote to memory of 1936	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 3704 wrote to memory of 1936	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 1936 wrote to memory of 116	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 1936 wrote to memory of 116	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 1936 wrote to memory of 116	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\CBFIJEGIDBGI" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	feeldog.xyz	udp
US	52.111.227.11:443		tcp

Files

memory/4372-0-0x00007FFBF7160000-0x00007FFBF72D2000-memory.dmp

memory/4372-11-0x00007FFBF7178000-0x00007FFBF7179000-memory.dmp

memory/4372-12-0x00007FFBF7160000-0x00007FFBF72D2000-memory.dmp

memory/4372-13-0x00007FFBF7160000-0x00007FFBF72D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\957bc8a9

MD5	decc10e5ae1f6a992610d088e965255c
SHA1	0a6c0eaae7c9a9f8a674b356cc11e04d568c7c88
SHA256	3969fc6b537423cd0eac0830979405bc34ad436ecaf74e25274e9e57a6908285
SHA512	48df4abec59fad914317d3a0487cf66e639d04e221f80804d6b61b139f968ffc7941d29f50c67f42fc329f3e6ba91735c0b0ac909677b1b44023dd81501bab57

memory/4920-16-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/3704-22-0x0000000001680000-0x0000000001DCB000-memory.dmp

memory/3704-24-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

memory/3704-25-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/3704-37-0x0000000001680000-0x0000000001DCB000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240226-en

Max time kernel

140s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_windows.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_windows.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.180.10:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	10.180.250.142.in-addr.arpa	udp
US	8.8.8.8:53	200.64.52.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_desktop_sleep_plugin.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_desktop_sleep_plugin.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1060,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240611-en

Max time kernel

93s

Max time network

102s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\msvcp140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\msvcp140.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.75:443	www.bing.com	tcp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	75.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

162s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\url_launcher_windows_plugin.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\url_launcher_windows_plugin.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.129:443	www.bing.com	tcp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	129.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
IE	52.111.236.22:443		tcp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	200.64.52.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.89:443	www.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	67.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	89.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	129.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-synch-l1-2-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240611-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_desktop_sleep_plugin.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1380 wrote to memory of 2016	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1380 wrote to memory of 2016	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1380 wrote to memory of 2016	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_desktop_sleep_plugin.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1380 -s 204

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	114.83.221.88.in-addr.arpa	udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win7-20240611-en

Max time kernel

118s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2436 wrote to memory of 2692	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2436 wrote to memory of 2692	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2436 wrote to memory of 2692	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2436 -s 84

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:52

Platform

win10v2004-20240226-en

Max time kernel

140s

Max time network

160s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\windows_single_instance_plugin.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\windows_single_instance_plugin.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	75.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	13.107.246.64:443		tcp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	18.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win7-20240220-en

Max time kernel

141s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2432 set thread context of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2432 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2432 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2432 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2432 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2432 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2492 wrote to memory of 2640	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2492 wrote to memory of 2640	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2492 wrote to memory of 2640	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2492 wrote to memory of 2640	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2492 wrote to memory of 2640	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2492 wrote to memory of 2640	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2640 wrote to memory of 2352	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2640 wrote to memory of 2352	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2640 wrote to memory of 2352	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2640 wrote to memory of 2352	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 148

Network

N/A

Files

memory/2432-10-0x000007FEF5C08000-0x000007FEF5C09000-memory.dmp

memory/2432-11-0x000007FEF5BF1000-0x000007FEF5C09000-memory.dmp

memory/2432-13-0x000007FEF5BF1000-0x000007FEF5C09000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7a6ca4c4

MD5	168985a15bef46ebd10b275e31e46c9d
SHA1	4a5d4834db6dd2831f9c30f4de62fa589869e1af
SHA256	1fb22e0eb5240e5c941141589a94a74724570de7fa92af5762d90c310ac1e3bf
SHA512	6e57719b0723e8a5dfbd0b84e96e4c35588741acf9e5969c749b88d542c5b875fd97950270ced41d2c42140ad77db253361d06b6594fc6c794f2f2ab01a3aa51

memory/2492-15-0x0000000077230000-0x00000000773D9000-memory.dmp

memory/2492-17-0x0000000073530000-0x00000000736A4000-memory.dmp

memory/2492-19-0x0000000073530000-0x00000000736A4000-memory.dmp

memory/2492-18-0x000000007353E000-0x0000000073540000-memory.dmp

\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2640-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2640-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2492-26-0x0000000073530000-0x00000000736A4000-memory.dmp

memory/2640-28-0x0000000000700000-0x0000000000E4B000-memory.dmp

memory/2640-35-0x0000000000700000-0x0000000000E4B000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-15 17:49

Reported

2024-06-15 17:51

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

55s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_1.dll,#1

Network

Files

N/A

Sample ID	240615-wd1sasyhpc
Target	#)#NEw_SetUp_33778_P@$$Key#(#.zip
SHA256	12ca25e6461fd5a1178fdc0a4b23cfa88225dec174fbd48ff6587a50b24d5a38
Tags	stealc vidar discovery spyware stealer

Malware Analysis Report

2024-09-11 16:48

Table of Contents