Overview
overview
10Static
static
3Loader.exe
windows7-x64
7Loader.exe
windows10-2004-x64
10diaguard.dll
windows7-x64
1diaguard.dll
windows10-2004-x64
1msys-2.0.dll
windows7-x64
7msys-2.0.dll
windows10-2004-x64
10tmpD01A.dll
windows7-x64
1tmpD01A.dll
windows10-2004-x64
1vcruntime140.dll
windows7-x64
1vcruntime140.dll
windows10-2004-x64
1winAPI.exe
windows7-x64
7winAPI.exe
windows10-2004-x64
10Analysis
- max time kernel
120s - max time network
152s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
05/08/2024, 11:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral3
Sample
diaguard.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
diaguard.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
msys-2.0.dll
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
msys-2.0.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral7
Sample
tmpD01A.dll
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
tmpD01A.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
vcruntime140.dll
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
vcruntime140.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
winAPI.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
winAPI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
30 signatures
150 seconds
General
- Target msys-2.0.dll
- Size 88KB
- Sample240805-nmcstsvdmr
- SHA256 282a5d95421706a6934034f41b5715329219f3120d974f5feeaef33b908de225
- MD5 bc28ce9500491be20df85d4cf2b823f1
- SHA1 d25389e205f09659e579e0582447f146ca2f8674
- SHA512 b122350555a2f16cc4aeae15f2aff8ff360658e2d6e0d6f4c1c01d09cdec529405fbf615263ed17032891464368d908ab6762a5bc123f25473e9b8abdf437ca2
- SSDEEP 1536:zsnsTDMfCgjgibbqJ7tJ2Lr/lWzv0EH80OrxECICtfyeL5eim:InOo6yOJRJ2X/czv0EH80OrxE9CtfyeC
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2924 xiqvhb.exe 1796 xiqvhb.exe 1212 Process not Found - Loads dropped DLL 9 IoCs
pid Process 2920 cmd.exe 2924 xiqvhb.exe 1796 xiqvhb.exe 1796 xiqvhb.exe 1796 xiqvhb.exe 1796 xiqvhb.exe 1796 xiqvhb.exe 1796 xiqvhb.exe 1796 xiqvhb.exe -
resource yara_rule behavioral5/files/0x000500000001a530-101.dat upx behavioral5/memory/1796-103-0x000007FEF54A0000-0x000007FEF5A88000-memory.dmp upx - Detects Pyinstaller 1 IoCs
resource yara_rule behavioral5/files/0x000a00000001202b-3.dat pyinstaller - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2360 rundll32.exe Token: SeBackupPrivilege 2360 rundll32.exe Token: SeDebugPrivilege 2360 rundll32.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2160 2360 rundll32.exe 30 PID 2360 wrote to memory of 2160 2360 rundll32.exe 30 PID 2360 wrote to memory of 2160 2360 rundll32.exe 30 PID 2160 wrote to memory of 2376 2160 cmd.exe 32 PID 2160 wrote to memory of 2376 2160 cmd.exe 32 PID 2160 wrote to memory of 2376 2160 cmd.exe 32 PID 2376 wrote to memory of 2920 2376 winAPI.dll 34 PID 2376 wrote to memory of 2920 2376 winAPI.dll 34 PID 2376 wrote to memory of 2920 2376 winAPI.dll 34 PID 2920 wrote to memory of 2924 2920 cmd.exe 36 PID 2920 wrote to memory of 2924 2920 cmd.exe 36 PID 2920 wrote to memory of 2924 2920 cmd.exe 36 PID 2924 wrote to memory of 1796 2924 xiqvhb.exe 37 PID 2924 wrote to memory of 1796 2924 xiqvhb.exe 37 PID 2924 wrote to memory of 1796 2924 xiqvhb.exe 37
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msys-2.0.dll,#11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c winAPI.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\winAPI.dllwinAPI.dll3⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "start C:\Users\Admin\AppData\Local\Temp\xiqvhb.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\xiqvhb.exeC:\Users\Admin\AppData\Local\Temp\xiqvhb.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\xiqvhb.exeC:\Users\Admin\AppData\Local\Temp\xiqvhb.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI29242\api-ms-win-core-file-l2-1-0.dll
- Size 18KB
- SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
- MD5 bfffa7117fd9b1622c66d949bac3f1d7
- SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
- SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
- SSDEEP 384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI29242\api-ms-win-core-localization-l1-2-0.dll
- Size 21KB
- SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
- MD5 724223109e49cb01d61d63a8be926b8f
- SHA1 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
- SHA512 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c
- SSDEEP 384:0naOMw3zdp3bwjGzue9/0jCRrndbnWqhW5lFydVXC4deR9zVj7xR:FOMwBprwjGzue9/0jCRrndbtGydVXC4O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI29242\api-ms-win-core-processthreads-l1-1-1.dll
- Size 21KB
- SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
- MD5 517eb9e2cb671ae49f99173d7f7ce43f
- SHA1 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
- SHA512 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be
- SSDEEP 192:R0DfIeUWqhWLWJWadJCsVWQ4mWFVyttuX01k9z3A2YHmp:R0DfIeUWqhWiCsLSR9zfYHmp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI29242\api-ms-win-core-timezone-l1-1-0.dll
- Size 21KB
- SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
- MD5 d12403ee11359259ba2b0706e5e5111c
- SHA1 03cc7827a30fd1dee38665c0cc993b4b533ac138
- SHA512 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0
- SSDEEP 192:HNpWqhW5WJWadJCsVWQ4mWbZyttuX01k9z3A2qkFU:HXWqhW4Cs1SR9zf9U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI29242\python311.dll
- Size 1.6MB
- SHA256 b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
- MD5 db09c9bbec6134db1766d369c339a0a1
- SHA1 c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
- SHA512 653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45
- SSDEEP 49152:I0/71KAZkPw/a5lsjIa7hhXBOQSbMS5ffODwKh/Wc:nziPwCvZalhXOMIzQd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI29242\ucrtbase.dll
- Size 992KB
- SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
- MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
- SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
- SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
- SSDEEP 24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\_MEI29242\api-ms-win-core-file-l1-2-0.dll
- Size 21KB
- SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
- MD5 1c58526d681efe507deb8f1935c75487
- SHA1 0e6d328faf3563f2aae029bc5f2272fb7a742672
- SHA512 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1
- SSDEEP 192:iDGaWqhWhWJWadJCsVWQ4mWd9afKUSIX01k9z3AEXzAU9:i6aWqhWACs92IR9z5EU9
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\xiqvhb.exe
- Size 11.6MB
- SHA256 da789a7653878711e481cbb64cd70506ef0722fea35c4aef8c0f937c6d859544
- MD5 19ee0c62d058248939477b1820914f2a
- SHA1 27e2456ec9032f75c60408090227b3f4d988b2d0
- SHA512 77251640b494a4757dbbc69414b43897f6b5f43169b6ab5ba7d0b60c4e0cefa18099c6fa8d42901ead2624b32207a227aa73bfd1871f3e50ce0219d7ba4408aa
- SSDEEP 196608:8xEWvPA+mtSreNvX+wfm/pf+xfdjSEqRZyTlKsn+rwWOtW0DaF1H:gEdRtSQvX+9/pWF8NRGAsn+rwWIRajH
- MD5 SHA1 SHA512 SSDEEP