Overview
overview
7Static
static
7velocityty...RU.exe
windows7-x64
1velocityty...RU.exe
windows10-2004-x64
1velocityty...ll.exe
windows7-x64
1velocityty...ll.exe
windows10-2004-x64
1velocityty...rt.exe
windows7-x64
4velocityty...rt.exe
windows10-2004-x64
5velocityty...64.exe
windows7-x64
4velocityty...64.exe
windows10-2004-x64
5velocityty...SO.exe
windows7-x64
7velocityty...SO.exe
windows10-2004-x64
7velocityty...ST.exe
windows7-x64
7velocityty...ST.exe
windows10-2004-x64
7velocityty...ed.exe
windows7-x64
7velocityty...ed.exe
windows10-2004-x64
7velocityty...in.bat
windows7-x64
1velocityty...in.bat
windows10-2004-x64
1velocityty...rl.dll
windows7-x64
1velocityty...rl.dll
windows10-2004-x64
1velocityty...b1.dll
windows7-x64
1velocityty...b1.dll
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 17:08
Behavioral task
behavioral1
Sample
velocitytytytyt/Monitor Spoof/CRU.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
velocitytytytyt/Monitor Spoof/CRU.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
velocitytytytyt/Monitor Spoof/reset-all.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
velocitytytytyt/Monitor Spoof/reset-all.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
velocitytytytyt/Monitor Spoof/restart.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
velocitytytytyt/Monitor Spoof/restart.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
velocitytytytyt/Monitor Spoof/restart64.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
velocitytytytyt/Monitor Spoof/restart64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
velocitytytytyt/RUN ME ALSO.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
velocitytytytyt/RUN ME ALSO.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
velocitytytytyt/RUN ME FIRST.exe
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
velocitytytytyt/RUN ME FIRST.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
velocitytytytyt/Velo.cc Spoofer_protected.exe
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
velocitytytytyt/Velo.cc Spoofer_protected.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
velocitytytytyt/Wifi & Bluetooth disabler/Disabler_Run_Admin.bat
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
velocitytytytyt/Wifi & Bluetooth disabler/Disabler_Run_Admin.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
velocitytytytyt/libcurl.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
velocitytytytyt/libcurl.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
velocitytytytyt/zlib1.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
velocitytytytyt/zlib1.dll
Resource
win10v2004-20240508-en
General
-
Target
velocitytytytyt/RUN ME ALSO.exe
-
Size
288KB
-
MD5
2cbd6ad183914a0c554f0739069e77d7
-
SHA1
7bf35f2afca666078db35ca95130beb2e3782212
-
SHA256
2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
-
SHA512
ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
-
SSDEEP
6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
dxwsetup.exepid process 2740 dxwsetup.exe -
Loads dropped DLL 2 IoCs
Processes:
dxwsetup.exepid process 2740 dxwsetup.exe 2740 dxwsetup.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RUN ME ALSO.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" RUN ME ALSO.exe -
Drops file in System32 directory 7 IoCs
Processes:
dxwsetup.exedescription ioc process File opened for modification C:\Windows\SysWOW64\directx\websetup\SET589F.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET589F.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET58B0.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET58B0.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup32.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup dxwsetup.exe -
Drops file in Windows directory 1 IoCs
Processes:
dxwsetup.exedescription ioc process File opened for modification C:\Windows\Logs\DirectX.log dxwsetup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
RUN ME ALSO.exedescription pid process target process PID 2780 wrote to memory of 2740 2780 RUN ME ALSO.exe dxwsetup.exe PID 2780 wrote to memory of 2740 2780 RUN ME ALSO.exe dxwsetup.exe PID 2780 wrote to memory of 2740 2780 RUN ME ALSO.exe dxwsetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\velocitytytytyt\RUN ME ALSO.exe"C:\Users\Admin\AppData\Local\Temp\velocitytytytyt\RUN ME ALSO.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5984cad22fa542a08c5d22941b888d8dc
SHA13e3522e7f3af329f2235b0f0850d664d5377b3cd
SHA25657bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308
SHA5128ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef
-
Filesize
515KB
MD5ac3a5f7be8cd13a863b50ab5fe00b71c
SHA1eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9
SHA2568f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da
SHA512c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba
-
Filesize
477B
MD5ad8982eaa02c7ad4d7cdcbc248caa941
SHA14ccd8e038d73a5361d754c7598ed238fc040d16b
SHA256d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
SHA5125c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
-
Filesize
1.5MB
MD5a5412a144f63d639b47fcc1ba68cb029
SHA181bd5f1c99b22c0266f3f59959dfb4ea023be47e
SHA2568a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
SHA5122679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405