Overview
overview
7Static
static
3assets/obj...36.ps1
windows11-21h2-x64
6assets/obj...3b.png
windows11-21h2-x64
3assets/obj...4e.ps1
windows11-21h2-x64
6bin/EaglerGradle
windows11-21h2-x64
1bin/EaglerGradle.bat
windows11-21h2-x64
1lib/Eagler....0.jar
windows11-21h2-x64
1lib/authli...25.jar
windows11-21h2-x64
1lib/codecj...23.jar
windows11-21h2-x64
1lib/codecw...23.jar
windows11-21h2-x64
1lib/common...10.jar
windows11-21h2-x64
1lib/common....1.jar
windows11-21h2-x64
1lib/common....5.jar
windows11-21h2-x64
1lib/common....5.jar
windows11-21h2-x64
1lib/common....3.jar
windows11-21h2-x64
1lib/fastut....0.jar
windows11-21h2-x64
1lib/gson-2.8.0.jar
windows11-21h2-x64
1lib/guava-21.0.jar
windows11-21h2-x64
1lib/httpcl....3.jar
windows11-21h2-x64
1lib/httpco....2.jar
windows11-21h2-x64
1lib/icu4j-....2.jar
windows11-21h2-x64
1lib/jinput-2.0.5.jar
windows11-21h2-x64
1lib/jna-4.4.0.jar
windows11-21h2-x64
7lib/jopt-s....3.jar
windows11-21h2-x64
1lib/jsr305-3.0.1.jar
windows11-21h2-x64
1lib/jutils-1.0.0.jar
windows11-21h2-x64
1lib/librar...23.jar
windows11-21h2-x64
1lib/librar...24.jar
windows11-21h2-x64
1lib/log4j-....1.jar
windows11-21h2-x64
1lib/log4j-....1.jar
windows11-21h2-x64
1lib/lwjgl-...09.jar
windows11-21h2-x64
1lib/lwjgl_...09.jar
windows11-21h2-x64
1lib/netty-...al.jar
windows11-21h2-x64
1Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-08-2024 01:16
Static task
static1
Behavioral task
behavioral1
Sample
assets/objects/90/90046a9705756370acd9a00502aab5785a2c2136.ps1
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
assets/objects/a4/a4a98367908a3a2fb5c6f11021c513d506532b3b.png
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
assets/objects/c3/c3cd0db760c980287b26ef9c0894f66c4250724e.ps1
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
bin/EaglerGradle
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
bin/EaglerGradle.bat
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
lib/EaglerGradle-1.0.0.jar
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
lib/authlib-1.5.25.jar
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
lib/codecjorbis-20101023.jar
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
lib/codecwav-20101023.jar
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
lib/commons-codec-1.10.jar
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
lib/commons-compress-1.8.1.jar
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
lib/commons-io-2.5.jar
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
lib/commons-lang3-3.5.jar
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
lib/commons-logging-1.1.3.jar
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
lib/fastutil-7.1.0.jar
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
lib/gson-2.8.0.jar
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
lib/guava-21.0.jar
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
lib/httpclient-4.3.3.jar
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
lib/httpcore-4.3.2.jar
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
lib/icu4j-core-mojang-51.2.jar
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
lib/jinput-2.0.5.jar
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
lib/jna-4.4.0.jar
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
lib/jopt-simple-5.0.3.jar
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
lib/jsr305-3.0.1.jar
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
lib/jutils-1.0.0.jar
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
lib/libraryjavasound-20101123.jar
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
lib/librarylwjglopenal-20100824.jar
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
lib/log4j-api-2.8.1.jar
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
lib/log4j-core-2.8.1.jar
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
lib/lwjgl-2.9.4-nightly-20150209.jar
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
lib/lwjgl_util-2.9.4-nightly-20150209.jar
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
lib/netty-all-4.1.9.Final.jar
Resource
win11-20240802-en
General
-
Target
assets/objects/90/90046a9705756370acd9a00502aab5785a2c2136.ps1
-
Size
28KB
-
MD5
a4cd2e91b6fb43d5024f341404cb79a4
-
SHA1
90046a9705756370acd9a00502aab5785a2c2136
-
SHA256
77f660dbf894ee68e186da517e07bf2575c51a3b0d91c542b950adc45d5d6226
-
SHA512
551fa3436cf6302c1f27f7e054653beb3faa74409df44cccd8a2fb5cc5c866ea55a268bbbb1aa2a290cb688970702e64532f86fadf2c99dd2a11fa57fe3f96bf
-
SSDEEP
768:ALVsFalNRm2q1xy2SIRvLDs8L1V/eYMpLB2iz+54XWa:AknzvLgO1ALptNzya
Malware Config
Signatures
-
pid Process 4660 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4660 powershell.exe 4660 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4660 powershell.exe Token: 33 484 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 484 AUDIODG.EXE
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\assets\objects\90\90046a9705756370acd9a00502aab5785a2c2136.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E81⤵
- Suspicious use of AdjustPrivilegeToken
PID:484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82