Overview
overview
10Static
static
3Wave (1).rar
windows10-2004-x64
5Wave/Crack...re.dll
windows10-2004-x64
3Wave/Crack...ss.exe
windows10-2004-x64
1Wave/Crack...me.dll
windows10-2004-x64
3Wave/Crack...re.dll
windows10-2004-x64
1Wave/Crack...pf.dll
windows10-2004-x64
1Wave/Crack...rp.dll
windows10-2004-x64
1Wave/Crack...ve.exe
windows10-2004-x64
10Wave/Crack...er.exe
windows10-2004-x64
1Wave/Crack...nd.mp4
windows10-2004-x64
6Wave/Crack...z4.dll
windows10-2004-x64
1Wave/Crack...sl.dll
windows10-2004-x64
1Wave/Crack...sh.dll
windows10-2004-x64
1Wave/Crack...b1.dll
windows10-2004-x64
1Wave/Crack...td.dll
windows10-2004-x64
1Wave/Crack...nt.pak
windows10-2004-x64
3Wave/Crack...nt.pak
windows10-2004-x64
3Wave/Crack...lf.dll
windows10-2004-x64
1Wave/Crack...47.dll
windows10-2004-x64
3Wave/Crack...tl.dat
windows10-2004-x64
3Wave/Crack...GL.dll
windows10-2004-x64
1Wave/Crack...v2.dll
windows10-2004-x64
1Wave/Crack...ef.dll
windows10-2004-x64
1Wave/Crack...US.pak
windows10-2004-x64
3Wave/Crack...es.pak
windows10-2004-x64
3Wave/Crack...ot.bin
windows10-2004-x64
3Wave/Crack...er.dll
windows10-2004-x64
3Wave/IMPOR...NG.txt
windows10-2004-x64
1Analysis
-
max time kernel
137s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 18:26
Static task
static1
Behavioral task
behavioral1
Sample
Wave (1).rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
Wave/CrackedWave/CefSharp.BrowserSubprocess.Core.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Wave/CrackedWave/CefSharp.BrowserSubprocess.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
Wave/CrackedWave/CefSharp.Core.Runtime.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Wave/CrackedWave/CefSharp.Core.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
Wave/CrackedWave/CefSharp.Wpf.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Wave/CrackedWave/CefSharp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral8
Sample
Wave/CrackedWave/CrackedWave.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Wave/CrackedWave/WaveBootstrapper.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral10
Sample
Wave/CrackedWave/bin/Background.mp4
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Wave/CrackedWave/bin/lz4.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
Wave/CrackedWave/bin/wolfssl.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Wave/CrackedWave/bin/xxhash.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
Wave/CrackedWave/bin/zlib1.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Wave/CrackedWave/bin/zstd.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
Wave/CrackedWave/chrome_100_percent.pak
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Wave/CrackedWave/chrome_200_percent.pak
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
Wave/CrackedWave/chrome_elf.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
Wave/CrackedWave/d3dcompiler_47.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
Wave/CrackedWave/icudtl.dat
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Wave/CrackedWave/libEGL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
Wave/CrackedWave/libGLESv2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Wave/CrackedWave/libcef.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
Wave/CrackedWave/locales/en-US.pak
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
Wave/CrackedWave/resources.pak
Resource
win10v2004-20240709-en
Behavioral task
behavioral26
Sample
Wave/CrackedWave/v8_context_snapshot.bin
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
Wave/CrackedWave/vk_swiftshader.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral28
Sample
Wave/IMPORTANT READ FIRST BEFORE OPENING.txt
Resource
win10v2004-20240709-en
General
-
Target
Wave/CrackedWave/libEGL.dll
-
Size
359KB
-
MD5
7dd6b0e4a31d35a0fae5ff425707073c
-
SHA1
fbd12e9f8e2252c52ce555c2ebbd7f07e62a0140
-
SHA256
8762d8001fc3ddd90e3129dfea172817e8d09b9936eaae391957de4326c8c906
-
SHA512
726968df6b83ab5f589276672250d92f532fe2dcea2176e42031a7f1dcecf578b0320cfe2a7d88bb9883ad99387d71c6ebf1e9968272bb5e62850ef09abd2648
-
SSDEEP
6144:74otxiotonwSbWTbrTEHdyVwiCSH/gWqkEC/D789uOSna:soL3VCWTbrTEHdyZp6I
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2120 wrote to memory of 244 2120 rundll32.exe 87 PID 2120 wrote to memory of 244 2120 rundll32.exe 87 PID 2120 wrote to memory of 244 2120 rundll32.exe 87
Processes
Network
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301494_1H867DXM62U58USJP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301494_1H867DXM62U58USJP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 547518
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 69573421366B42CA9D687D344D895E2D Ref B: LON04EDGE0815 Ref C: 2024-07-22T18:31:38Z
date: Mon, 22 Jul 2024 18:31:37 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301061_198BRK9UD0M5A9F9K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301061_198BRK9UD0M5A9F9K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 449795
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BC460064A9D54474ABC02638932034EF Ref B: LON04EDGE0815 Ref C: 2024-07-22T18:31:38Z
date: Mon, 22 Jul 2024 18:31:37 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360312918_180TGJBF6DGGGWMR4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239360312918_180TGJBF6DGGGWMR4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 520026
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2148C765B6B344F48BB4A689C1E86E38 Ref B: LON04EDGE0815 Ref C: 2024-07-22T18:31:38Z
date: Mon, 22 Jul 2024 18:31:37 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388089_1YWQX3ZEHR4OT6WAR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239339388089_1YWQX3ZEHR4OT6WAR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 785290
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 51A7E5E01C8C49F79BAC6D29667BF9E5 Ref B: LON04EDGE0815 Ref C: 2024-07-22T18:31:38Z
date: Mon, 22 Jul 2024 18:31:37 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360312917_16ZMDWEI5FV6CL9RM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239360312917_16ZMDWEI5FV6CL9RM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 431666
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8FECF787DF67447AB59BCBA31948AB45 Ref B: LON04EDGE0815 Ref C: 2024-07-22T18:31:38Z
date: Mon, 22 Jul 2024 18:31:37 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388090_10COBJKKIBLJ6TLQ0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239339388090_10COBJKKIBLJ6TLQ0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 729980
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BB0FD12866AE4F699124D0D8FB1A1646 Ref B: LON04EDGE0815 Ref C: 2024-07-22T18:31:38Z
date: Mon, 22 Jul 2024 18:31:38 GMT
-
1.2kB 6.9kB 15 13
-
150.171.28.10:443https://tse1.mm.bing.net/th?id=OADD2.10239339388090_10COBJKKIBLJ6TLQ0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2148.2kB 3.6MB 2613 2605
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301494_1H867DXM62U58USJP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301061_198BRK9UD0M5A9F9K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360312918_180TGJBF6DGGGWMR4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388089_1YWQX3ZEHR4OT6WAR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360312917_16ZMDWEI5FV6CL9RM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388090_10COBJKKIBLJ6TLQ0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200 -
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.160.190.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.28.10150.171.27.10