Overview
overview
10Static
static
3ResIL.dll
windows7-x64
1ResIL.dll
windows10-1703-x64
3ResIL.dll
windows10-2004-x64
3ResIL.dll
windows11-21h2-x64
3libGLESv2.dll
windows7-x64
3libGLESv2.dll
windows10-1703-x64
3libGLESv2.dll
windows10-2004-x64
3libGLESv2.dll
windows11-21h2-x64
3res_mods/1...zA.exe
windows7-x64
1res_mods/1...zA.exe
windows10-1703-x64
1res_mods/1...zA.exe
windows10-2004-x64
1res_mods/1...zA.exe
windows11-21h2-x64
1setup.exe
windows7-x64
10setup.exe
windows10-1703-x64
10setup.exe
windows10-2004-x64
10setup.exe
windows11-21h2-x64
10updates/Un...00.exe
windows7-x64
7updates/Un...00.exe
windows10-1703-x64
7updates/Un...00.exe
windows10-2004-x64
7updates/Un...00.exe
windows11-21h2-x64
7Just.TankC...te.zip
windows7-x64
1Just.TankC...te.zip
windows10-1703-x64
1Just.TankC...te.zip
windows10-2004-x64
1Just.TankC...te.zip
windows11-21h2-x64
1vivoxsdk.dll
windows7-x64
1vivoxsdk.dll
windows10-1703-x64
1vivoxsdk.dll
windows10-2004-x64
1vivoxsdk.dll
windows11-21h2-x64
1Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 16:45
Static task
static1
Behavioral task
behavioral1
Sample
ResIL.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ResIL.dll
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
ResIL.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral4
Sample
ResIL.dll
Resource
win11-20240704-en
Behavioral task
behavioral5
Sample
libGLESv2.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
libGLESv2.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
libGLESv2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
libGLESv2.dll
Resource
win11-20240704-en
Behavioral task
behavioral9
Sample
res_mods/1.23.0.0/scripts/client/gui/mods/7zA.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
res_mods/1.23.0.0/scripts/client/gui/mods/7zA.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
res_mods/1.23.0.0/scripts/client/gui/mods/7zA.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral12
Sample
res_mods/1.23.0.0/scripts/client/gui/mods/7zA.exe
Resource
win11-20240704-en
Behavioral task
behavioral13
Sample
setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
setup.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral16
Sample
setup.exe
Resource
win11-20240704-en
Behavioral task
behavioral17
Sample
updates/Uninstall/unins000.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
updates/Uninstall/unins000.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
updates/Uninstall/unins000.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral20
Sample
updates/Uninstall/unins000.exe
Resource
win11-20240704-en
Behavioral task
behavioral21
Sample
Just.TankCrashWhite.zip
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
Just.TankCrashWhite.zip
Resource
win10-20240611-en
Behavioral task
behavioral23
Sample
Just.TankCrashWhite.zip
Resource
win10v2004-20240704-en
Behavioral task
behavioral24
Sample
Just.TankCrashWhite.zip
Resource
win11-20240508-en
Behavioral task
behavioral25
Sample
vivoxsdk.dll
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
vivoxsdk.dll
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
vivoxsdk.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral28
Sample
vivoxsdk.dll
Resource
win11-20240704-en
General
-
Target
updates/Uninstall/unins000.exe
-
Size
1.5MB
-
MD5
3ab31d714c50ae078f9eaba7b2497191
-
SHA1
45c5e807e459d95618c03a6ded9debe1d70013f3
-
SHA256
4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
-
SHA512
f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae
-
SSDEEP
24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKMrexLxB:cIEJxCWluyZ8UbMZz
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
_iu14D2N.tmppid process 4464 _iu14D2N.tmp -
Executes dropped EXE 1 IoCs
Processes:
_iu14D2N.tmppid process 4464 _iu14D2N.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
_iu14D2N.tmppid process 4464 _iu14D2N.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
unins000.exedescription pid process target process PID 2440 wrote to memory of 4464 2440 unins000.exe _iu14D2N.tmp PID 2440 wrote to memory of 4464 2440 unins000.exe _iu14D2N.tmp PID 2440 wrote to memory of 4464 2440 unins000.exe _iu14D2N.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe" /FIRSTPHASEWND=$B00762⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:4464
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmpFilesize
1.5MB
MD53ab31d714c50ae078f9eaba7b2497191
SHA145c5e807e459d95618c03a6ded9debe1d70013f3
SHA2564f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
SHA512f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae
-
memory/2440-0-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/2440-11-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB
-
memory/4464-6-0x0000000000770000-0x0000000000771000-memory.dmpFilesize
4KB
-
memory/4464-12-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB
-
memory/4464-15-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB