Overview
overview
7Static
static
3PolyMC-Win....1.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows10-2004-x64
1iconengine...on.dll
windows10-2004-x64
1imageformats/qgif.dll
windows10-2004-x64
1imageforma...ns.dll
windows10-2004-x64
1imageformats/qico.dll
windows10-2004-x64
1imageformats/qjp2.dll
windows10-2004-x64
1imageforma...eg.dll
windows10-2004-x64
1imageformats/qsvg.dll
windows10-2004-x64
1imageforma...mp.dll
windows10-2004-x64
1imageforma...bp.dll
windows10-2004-x64
1jars/JavaCheck.jar
windows10-2004-x64
1jars/NewLaunch.jar
windows10-2004-x64
1libb2-1.dll
windows10-2004-x64
1libbrotlicommon.dll
windows10-2004-x64
1libbrotlidec.dll
windows10-2004-x64
1libbz2-1.dll
windows10-2004-x64
1libdouble-...on.dll
windows10-2004-x64
1libgraphite2.dll
windows10-2004-x64
1libharfbuzz-0.dll
windows10-2004-x64
1libjasper.dll
windows10-2004-x64
1libstdc++-6.dll
windows10-2004-x64
1libwebp-7.dll
windows10-2004-x64
1platforms/...ws.dll
windows10-2004-x64
1polymc.exe
windows10-2004-x64
7qt.conf
windows10-2004-x64
3tls/qcerto...nd.dll
windows10-2004-x64
1tls/qopens...nd.dll
windows10-2004-x64
1tls/qschan...nd.dll
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 23:16
Static task
static1
Behavioral task
behavioral1
Sample
PolyMC-Windows-Setup-6.1.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
iconengines/qsvgicon.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
imageformats/qgif.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral8
Sample
imageformats/qicns.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
imageformats/qico.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral10
Sample
imageformats/qjp2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
imageformats/qjpeg.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
imageformats/qsvg.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
imageformats/qwbmp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
imageformats/qwebp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
jars/JavaCheck.jar
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
jars/NewLaunch.jar
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
libb2-1.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
libbrotlicommon.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
libbrotlidec.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
libbz2-1.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
libdouble-conversion.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
libgraphite2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
libharfbuzz-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
libjasper.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
libstdc++-6.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral26
Sample
libwebp-7.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
platforms/qwindows.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral28
Sample
polymc.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
qt.conf
Resource
win10v2004-20240709-en
Behavioral task
behavioral30
Sample
tls/qcertonlybackend.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
tls/qopensslbackend.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral32
Sample
tls/qschannelbackend.dll
Resource
win10v2004-20240704-en
General
-
Target
polymc.exe
-
Size
10.8MB
-
MD5
341d7ac79625c3ab885d90ed5ce9ab2b
-
SHA1
11139fcba6c8124dbe03a90058a2241dc7a70118
-
SHA256
7b8f33c02ba9e3fd92ae5df31088c47cef1afb0acd2c2eef1ecd309b465c84a4
-
SHA512
9adf7da50ac181d418e26f5feb22f6cc93e9b11299159ca58cfd8fd0e2c5d9a6376737a08dd8aab79f1a1d12d269ed77c23c779f1de8b91fa97dc42e622a6b31
-
SSDEEP
98304:dIzA2C+GqLsi9u7mSs6/VxJxm56rdYNU47WSMg2ENuKlJe5V3L:R64s6lx0GdHrpENXo
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
polymc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation polymc.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
polymc.exepid process 1792 polymc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
polymc.exepid process 1792 polymc.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1792-0-0x00007FF9DA520000-0x00007FF9DA6E8000-memory.dmpFilesize
1.8MB
-
memory/1792-2-0x00007FF9F4060000-0x00007FF9F408C000-memory.dmpFilesize
176KB
-
memory/1792-1-0x00007FF9EEB10000-0x00007FF9EEB26000-memory.dmpFilesize
88KB
-
memory/1792-19-0x00007FF9EF190000-0x00007FF9EF1A6000-memory.dmpFilesize
88KB
-
memory/1792-20-0x00007FF9EB930000-0x00007FF9EB954000-memory.dmpFilesize
144KB
-
memory/1792-18-0x00007FF712830000-0x00007FF71305D000-memory.dmpFilesize
8.2MB
-
memory/1792-23-0x00007FF9DBCF0000-0x00007FF9DBF1E000-memory.dmpFilesize
2.2MB
-
memory/1792-24-0x00007FF9DBB50000-0x00007FF9DBCE7000-memory.dmpFilesize
1.6MB
-
memory/1792-21-0x00007FF9DBF20000-0x00007FF9DC0DC000-memory.dmpFilesize
1.7MB
-
memory/1792-22-0x00007FF9EB680000-0x00007FF9EB6DE000-memory.dmpFilesize
376KB
-
memory/1792-25-0x00007FF9DAF40000-0x00007FF9DB580000-memory.dmpFilesize
6.2MB
-
memory/1792-26-0x00007FF9DB580000-0x00007FF9DBB46000-memory.dmpFilesize
5.8MB
-
memory/1792-27-0x00007FF9F4060000-0x00007FF9F408C000-memory.dmpFilesize
176KB
-
memory/1792-33-0x00007FF9DA520000-0x00007FF9DA6E8000-memory.dmpFilesize
1.8MB
-
memory/1792-39-0x00007FF9DA250000-0x00007FF9DA520000-memory.dmpFilesize
2.8MB
-
memory/1792-28-0x00007FF9DA6F0000-0x00007FF9DAF3C000-memory.dmpFilesize
8.3MB
-
memory/1792-46-0x00007FF9E9270000-0x00007FF9E92A4000-memory.dmpFilesize
208KB
-
memory/1792-45-0x00007FF9EAD90000-0x00007FF9EADBC000-memory.dmpFilesize
176KB
-
memory/1792-44-0x00007FF9DCB80000-0x00007FF9DCBC3000-memory.dmpFilesize
268KB
-
memory/1792-43-0x00007FF9EAF40000-0x00007FF9EAF60000-memory.dmpFilesize
128KB
-
memory/1792-42-0x00007FF9DA040000-0x00007FF9DA17D000-memory.dmpFilesize
1.2MB
-
memory/1792-41-0x00007FF9EB4E0000-0x00007FF9EB4FD000-memory.dmpFilesize
116KB
-
memory/1792-40-0x00007FF9DA180000-0x00007FF9DA244000-memory.dmpFilesize
784KB
-
memory/1792-38-0x00007FF9EADC0000-0x00007FF9EAEE3000-memory.dmpFilesize
1.1MB
-
memory/1792-37-0x00007FF9EAF60000-0x00007FF9EAFBE000-memory.dmpFilesize
376KB
-
memory/1792-36-0x00007FF9EB5C0000-0x00007FF9EB5D1000-memory.dmpFilesize
68KB
-
memory/1792-35-0x00007FF9EB5E0000-0x00007FF9EB5FA000-memory.dmpFilesize
104KB
-
memory/1792-34-0x00007FF9EB910000-0x00007FF9EB927000-memory.dmpFilesize
92KB
-
memory/1792-32-0x00007FF9EEB10000-0x00007FF9EEB26000-memory.dmpFilesize
88KB
-
memory/1792-30-0x00007FF9EAFC0000-0x00007FF9EB052000-memory.dmpFilesize
584KB
-
memory/1792-31-0x00007FF9EB580000-0x00007FF9EB5A4000-memory.dmpFilesize
144KB
-
memory/1792-29-0x00007FF9EB630000-0x00007FF9EB671000-memory.dmpFilesize
260KB
-
memory/1792-55-0x00007FF9DB580000-0x00007FF9DBB46000-memory.dmpFilesize
5.8MB
-
memory/1792-57-0x00007FF9DA6F0000-0x00007FF9DAF3C000-memory.dmpFilesize
8.3MB