Overview
overview
7Static
static
7droidkit-en-setup.exe
windows11-21h2-x64
4$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...Vs.dll
windows11-21h2-x64
3$PLUGINSDI...ib.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...up.exe
windows11-21h2-x64
7$PLUGINSDI...00.dll
windows11-21h2-x64
1$PLUGINSDI...00.dll
windows11-21h2-x64
1$PLUGINSDIR/nsDui.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...ss.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$PLUGINSDI...ry.dll
windows11-21h2-x64
3$PLUGINSDI...ll.exe
windows11-21h2-x64
4$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ib.dll
windows11-21h2-x64
3$PLUGINSDI...el.dll
windows11-21h2-x64
7$PLUGINSDI...tn.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI..._1.dll
windows11-21h2-x64
3$PLUGINSDI..._1.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ss.dll
windows11-21h2-x64
3$PLUGINSDI...ry.dll
windows11-21h2-x64
3$PLUGINSDIR/un.exe
windows11-21h2-x64
3Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-08-2024 07:59
Behavioral task
behavioral1
Sample
droidkit-en-setup.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/CheckProVs.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GoogleTracingLib.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/dotNetFx45_Full_setup.exe
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/msvcp100.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/msvcr100.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDui.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/registry.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/uninstall.exe
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/GoogleTracingLib.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/libcrypto-1_1.dll
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/libssl-1_1.dll
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/registry.dll
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/un.exe
Resource
win11-20240802-en
General
-
Target
$PLUGINSDIR/un.exe
-
Size
7.4MB
-
MD5
839640ba4c87b4a0fbd4d81fc54f8f51
-
SHA1
0fdf3cf3685de715f8206400a232bf389ce319d6
-
SHA256
58b8642b2665efde3974c18c2613b6e27dcf31fbb4b048339f93b2019c26d6df
-
SHA512
14b97fd80c8b58422949b9d8db2660e93c6ee7c41873e8388cc9b62396e791f346346465527088a50a58d6d9a358e21a8652a0934149dd6ed3947841a7e59354
-
SSDEEP
196608:SypQHMyhZz21iDr7Q8WjqvQ80j1FA9Epvk5MABT/4l8mBx88w:SypH+gADr70Wv6DA9G85nrc5lw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
un.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
un.exedescription pid process Token: SeDebugPrivilege 4088 un.exe