Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 10:03
Static task
static1
Behavioral task
behavioral1
Sample
AndroidSideloader v2.29.2.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
AndroidSideloader v2.29.2.exe
Resource
win10v2004-20240802-en
General
-
Target
AndroidSideloader v2.29.2.exe
-
Size
4.1MB
-
MD5
b7fa8a83dd1c92d93679c58d06691369
-
SHA1
0cff7bb71ff43ee92172f30566d8ee1b043129fc
-
SHA256
6cf2bcdb1a463fc69eddb125eba8cc12854ee23effcd7c65b968667c668a7f0b
-
SHA512
d74f8450f1fda260d0176ceba347bde6ad58b24a09eaac3cc921e20236a11707cab2f5eaee3bb10907c387d67efbcb66d823ae052b1317f3e953c4984a2b94b8
-
SSDEEP
24576:JUjV//Ppn/JcDJ7bdukqjVnlqud+/2P+AXg:S5//Rn/QJ7bYkqXfd+/9AQ
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
pid Process 216 7z.exe 416 7z.exe 2188 adb.exe 2840 adb.exe 3900 adb.exe 1400 rclone.exe 2040 rclone.exe 416 7z.exe 4456 adb.exe 3284 adb.exe 3856 adb.exe 820 adb.exe 1184 adb.exe -
Loads dropped DLL 16 IoCs
pid Process 2188 adb.exe 2188 adb.exe 2840 adb.exe 2840 adb.exe 3900 adb.exe 3900 adb.exe 4456 adb.exe 4456 adb.exe 3284 adb.exe 3284 adb.exe 3856 adb.exe 3856 adb.exe 820 adb.exe 820 adb.exe 1184 adb.exe 1184 adb.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 21 raw.githubusercontent.com 23 raw.githubusercontent.com 63 raw.githubusercontent.com -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AndroidSideloader v2.29.2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e AndroidSideloader v2.29.2.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\CA7788C32DA1E4B7863A4FB57D00B55DDACBC7F9 AndroidSideloader v2.29.2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C rclone.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 rclone.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 AndroidSideloader v2.29.2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e AndroidSideloader v2.29.2.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7F95276D4951499FD756DF344AA24FB38CEAF678 AndroidSideloader v2.29.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7F95276D4951499FD756DF344AA24FB38CEAF678\Blob = 0300000001000000140000007f95276d4951499fd756df344aa24fb38ceaf6781400000001000000140000000f6be64bce3947aef67e901e79f0309192c85fa3040000000100000010000000ee39380f325cf0c51f4c6f7be0a4c8990f000000010000003000000011634607adf75b5e2bb0c3f38525f19b8cb00415cf48940a83e1da5b90dbf3d251de3a2659675838654f1705ba8fe7411900000001000000100000007818fd06fa225d60f1172f1ef2efcebf5c00000001000000040000008001000018000000010000001000000076935b5c5a037216daaf8aac76df42c1200000000100000089030000308203853082030ca003020102021023b76de3c1bb2b1a51961e08eab764e8300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3230303133303030303030305a170d3330303132393233353935395a304b310b30090603550406130241543110300e060355040a13075a65726f53534c312a3028060355040313215a65726f53534c2045434320446f6d61696e2053656375726520536974652043413076301006072a8648ce3d020106052b8104002203620004364161172b5325edaaca94e4d6da4857ef50ba846482d7bb051bd61f0624f6a5339d8ce7f10b5568638230105f8d65ecaaa8af97cab586ce30018974dee34e5e016eee267bcc53fa23a4f7441d3e4d1e5f66a6ad85f6f2e3bc8e099880248e20a382017530820171301f0603551d230418301680143ae10986d4cf19c29676744976dce035c663639a301d0603551d0e041604140f6be64bce3947aef67e901e79f0309192c85fa3300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102024e3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737445434343657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374454343416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300a06082a8648ce3d040303036700306402302470540f01c940ddc854d96d54cac808ca984374d83ff4d7a95f6df261b9700a261b6330a88b319cbf77ec67b07fa588023025adaba4b0ee8d52e0dd0d7c9ddf7d1daee25c649c74f87e63e5c14e601686b0a75e196eec08c691d8fb0314a1a595ab AndroidSideloader v2.29.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\CA7788C32DA1E4B7863A4FB57D00B55DDACBC7F9\Blob = 030000000100000014000000ca7788c32da1e4b7863a4fb57d00b55ddacbc7f91400000001000000140000003ae10986d4cf19c29676744976dce035c663639a04000000010000001000000042f8529fe545103fdd848980a8647f290f0000000100000030000000ed080184c5a30d366162d70be6fbb98ed70ace8650c3b7bccc7687cddaffb50f7d12eea1a961cc6f7fd0da9b3422f9fa19000000010000001000000076935b5c5a037216daaf8aac76df42c15c0000000100000004000000800100001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000d7030000308203d3308202bba003020102021056671d04ea4f994c6f10814759d27594300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c0500038201010019eceb9d892c200b04801d18de429972991632bd0e9c755b2c15e229406deeff72dbdbab901f8c95f28a3d087242895007e239156c0187d9161af5c0752bc5e6561107dfd898bc7c9f1939df8bca006473bc46109b93238dbe16c32e08829c863374763b284c8d034285b3e2b22342d51f7a756a1ad17caa6721c4333a396d53c9a2ed6222a8bbe2556c996c436b9197d10c0b93021dd2bc697749e61b4df7bf147803b0a6ba0bb4e1857f2fdc423bad740148ded66ce11998095e0ab36747fe1ce0d5c128ef4a8b44312604378d8974362eefa5220f83744992c7f710c20c29fbb7bdba7fe35fd59ff2a9f474d5b8e1b3b081e4e1a563a3ccea0478906ebff7 AndroidSideloader v2.29.2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 rclone.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1400 rclone.exe 1400 rclone.exe 1400 rclone.exe 1400 rclone.exe 2040 rclone.exe 2040 rclone.exe 2040 rclone.exe 2040 rclone.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 2132 AndroidSideloader v2.29.2.exe Token: SeRestorePrivilege 216 7z.exe Token: 35 216 7z.exe Token: SeSecurityPrivilege 216 7z.exe Token: SeSecurityPrivilege 216 7z.exe Token: SeRestorePrivilege 416 7z.exe Token: 35 416 7z.exe Token: SeSecurityPrivilege 416 7z.exe Token: SeSecurityPrivilege 416 7z.exe Token: SeDebugPrivilege 1400 rclone.exe Token: SeDebugPrivilege 2040 rclone.exe Token: SeRestorePrivilege 416 7z.exe Token: 35 416 7z.exe Token: SeSecurityPrivilege 416 7z.exe Token: SeSecurityPrivilege 416 7z.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2132 wrote to memory of 216 2132 AndroidSideloader v2.29.2.exe 99 PID 2132 wrote to memory of 216 2132 AndroidSideloader v2.29.2.exe 99 PID 2132 wrote to memory of 416 2132 AndroidSideloader v2.29.2.exe 107 PID 2132 wrote to memory of 416 2132 AndroidSideloader v2.29.2.exe 107 PID 2132 wrote to memory of 2188 2132 AndroidSideloader v2.29.2.exe 109 PID 2132 wrote to memory of 2188 2132 AndroidSideloader v2.29.2.exe 109 PID 2132 wrote to memory of 2188 2132 AndroidSideloader v2.29.2.exe 109 PID 2132 wrote to memory of 2840 2132 AndroidSideloader v2.29.2.exe 111 PID 2132 wrote to memory of 2840 2132 AndroidSideloader v2.29.2.exe 111 PID 2132 wrote to memory of 2840 2132 AndroidSideloader v2.29.2.exe 111 PID 2840 wrote to memory of 3900 2840 adb.exe 113 PID 2840 wrote to memory of 3900 2840 adb.exe 113 PID 2840 wrote to memory of 3900 2840 adb.exe 113 PID 2132 wrote to memory of 1400 2132 AndroidSideloader v2.29.2.exe 114 PID 2132 wrote to memory of 1400 2132 AndroidSideloader v2.29.2.exe 114 PID 2132 wrote to memory of 2040 2132 AndroidSideloader v2.29.2.exe 116 PID 2132 wrote to memory of 2040 2132 AndroidSideloader v2.29.2.exe 116 PID 2132 wrote to memory of 416 2132 AndroidSideloader v2.29.2.exe 119 PID 2132 wrote to memory of 416 2132 AndroidSideloader v2.29.2.exe 119 PID 2132 wrote to memory of 4456 2132 AndroidSideloader v2.29.2.exe 121 PID 2132 wrote to memory of 4456 2132 AndroidSideloader v2.29.2.exe 121 PID 2132 wrote to memory of 4456 2132 AndroidSideloader v2.29.2.exe 121 PID 2132 wrote to memory of 3284 2132 AndroidSideloader v2.29.2.exe 123 PID 2132 wrote to memory of 3284 2132 AndroidSideloader v2.29.2.exe 123 PID 2132 wrote to memory of 3284 2132 AndroidSideloader v2.29.2.exe 123 PID 2132 wrote to memory of 3856 2132 AndroidSideloader v2.29.2.exe 125 PID 2132 wrote to memory of 3856 2132 AndroidSideloader v2.29.2.exe 125 PID 2132 wrote to memory of 3856 2132 AndroidSideloader v2.29.2.exe 125 PID 2132 wrote to memory of 820 2132 AndroidSideloader v2.29.2.exe 127 PID 2132 wrote to memory of 820 2132 AndroidSideloader v2.29.2.exe 127 PID 2132 wrote to memory of 820 2132 AndroidSideloader v2.29.2.exe 127 PID 2132 wrote to memory of 1184 2132 AndroidSideloader v2.29.2.exe 129 PID 2132 wrote to memory of 1184 2132 AndroidSideloader v2.29.2.exe 129 PID 2132 wrote to memory of 1184 2132 AndroidSideloader v2.29.2.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\AndroidSideloader v2.29.2.exe"C:\Users\Admin\AppData\Local\Temp\AndroidSideloader v2.29.2.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\7z.exe"7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dependencies.7z" -y -o"C:\RSL\platform-tools" -bsp12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe"7z.exe" x "C:\Users\Admin\AppData\Local\Temp\rclone.zip" -y -o"C:\Users\Admin\AppData\Local\Temp" -bsp12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" kill-server2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2188
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" start-server2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\RSL\platform-tools\adb.exeadb -L tcp:5037 fork-server server --reply-fd 5643⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3900
-
-
-
C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe"C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" listremotes --config vrp.download.config2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe"C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" sync ":http:/meta.7z" "C:\Users\Admin\AppData\Local\Temp" --http-url https://theapp.vrrookie.xyz/ --tpslimit 1.0 --tpslimit-burst 32⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe"7z.exe" x "C:\Users\Admin\AppData\Local\Temp\meta.7z" -y -o"C:\Users\Admin\AppData\Local\Temp\meta" -p"gL59VfgPxoHR" -bsp12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" devices2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4456
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell dumpsys battery2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3284
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell df2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3856
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell pm list packages -32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell df2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3840,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:81⤵PID:2300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5d79a7c0a425f768fc9f9bcf2aa144d8f
SHA13da9e4c4566bd6d4efeeaf7ceab9e9e83f2f67e5
SHA2561ad523231de449af3ba0e8664d3af332f0c5cc4f09141691ca05e35368fa811a
SHA512ff650b98ecc55df6c2cb1b22221b1e71d63c01324f8a8b0f05f1497f5416131f7c33ef2ea17ed323cb2bfdbe7ae1824474544434899d2cb89e9c8c00db7dbb15
-
Filesize
71KB
MD5e6e1716f53624aff7dbce5891334669a
SHA19c17f50ba4c8e5db9c1118d164995379f8d686fb
SHA25651a61758a6f1f13dd36530199c0d65e227cd9d43765372b2942944cc3296ca2c
SHA512c47392b6f7d701e78f78e0b0ddce5508ab8d247a4095391e77cd665e955f4938e412ffcb6076534dcad287af4f78d84668496935e71b9bb46a98401522815eb9
-
Filesize
5.6MB
MD564daf7cca61d468d26a407d79a7c26a9
SHA151b451089e73c9a03e2f24ab2fc81896d48c6126
SHA256997324a38d89e3b282306bf25ccaa167c49a35850ac0ab4a169e7a15afa82fc8
SHA5125a7bd06326e8ee868a2e6c724bc74bd290acaa00f3442807d3f69489a374a13a3cb41fbaf929c79525bdac319bd9a64ecfaf3cbdb6585ae332a485e911d8370d
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\14rcc52w.newcfg
Filesize3KB
MD5db7b16ffbb25211d160392fdacde8566
SHA1e3476ddbef02d584c7ee74b689dc7ecb93107b17
SHA2562b05a9392e60847ca07d051246d2316dc9033b093b59268754c961718a02a57e
SHA51249cd43a958776101b204f860a1c529106d63aae904a8ad3ca45ff1e5fb026870f26c4c86b2ce65bac43e91647d5e3f426b68f9fe78928a9996930232259298e1
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\5qcg4ynk.newcfg
Filesize3KB
MD59f8aed9db939604d4c54ea80dbd195d4
SHA192be91bb080e966f57b1e3e72c052ced96686891
SHA256c9af9aeaad19dcdb336407fd389e3875900973eac0c2ee64e6a81ee336894eb0
SHA512a1732807e9b7ecc0632c2a296a71a130fb5846c888733e73ff63ef50ad848ad69b094757e6f808891f42a60cd4d94b63a00542604c9706ecc204a250e2f9bb60
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\cwiuaq20.newcfg
Filesize2KB
MD5e6b27200893811d37b7a7cd50ff6d62d
SHA1ce44ab2b3699c887887858073dd60f95393ddee8
SHA2569fac8fcfa6adda234baf8c866402fc513b98344a445c1b699542c3cb5082b763
SHA512e22597deb03ad2ae725cbfba5e7cb043f941b4e920839ab6349d04eb6126c7d8bb52aa47834e24566cb63c2642ff5661ff7e2add3300a6553ce66da238f015a2
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\m5dnh1na.newcfg
Filesize2KB
MD5145bdfb757a5d571d8dc1e017a24100b
SHA13a08a3412bd2d386330a1378d32cb4803b9c3886
SHA256043460e55832ac4bb0c9f944ca62f8bd88f6e6b00a657e085a56460b520da8ed
SHA512f7c7d2140251e7b6c9ed9629beeeb40fa119c3a452d8eec82f95915d2f6000247812b3999af82b8ecfa5b9f80d39016636deaf1ba3e130a4002d5506a8d2503b
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\nq32dp1e.newcfg
Filesize3KB
MD583e180872cadcc0d352b6b503b36815a
SHA16ab2ccb6deadbde592f32bfc9b54918a5d6a98c2
SHA2567e06583a4e11a32db854666366eb59d9bd4584973af4869c877d760e0de44228
SHA51224d160787bec36c8572f505cf066170cf9952079af7f1964209f558bd9db940587f92156d40a152d57d48f45690f4cf7944afc16858cba0026f2d1cb57e5c73c
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\rdph0sky.newcfg
Filesize2KB
MD5ce838d9dac79df0410518d0706e46246
SHA10cb1adc31dbebd148d92042dcc0b6d6146cbe7ed
SHA256b0b4b2d2ddf45a92f76a115072b94fe8c1ab682a90323af2d72c34f52d9556ec
SHA5120e01ed5556a468e024d30589de1071293ed19f19a1f7be8a981b1640391089c4cff93125eca4501fedfbd2c5f1caaafaa779626bfe7f87add364b4eb31197f63
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\user.config
Filesize838B
MD56dc22626c68e39d1f7a92bc247d064fa
SHA106d72094b8ccfb2cd09e3b04fa79cd2f4efbb40c
SHA2565b1cfb327e8e4f605cdb650526ab442cc846ce97cfdc51d1da23dfecb3abdf60
SHA51209858fce9752da51c915859873510c5f115b8d2b2ffa9b3bfe8bee20b804de1fe3ef8bbe5448b2374d6089af29e9d7914e0098df675e5eef240d4f1649a0db72
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\user.config
Filesize2KB
MD5b8852b5108f38932eecf8cab9f361c41
SHA1f0ffe6adcb109bc44311049e3dd1de24f4dccac0
SHA256c03c95474e70631b58482e0f7f0665f8f41b29032bffa4848e356971623519e8
SHA51209b05d210b1fde224ce310cec507635b4400742925f772c914b3028b7c845eafadabac2cf5ff3a92d3945d6cb29b17b8ff225a801435eb7466783c901853bd73
-
Filesize
1.2MB
MD51a7eaa1dab7867e15d7800ae0b5af5e3
SHA19e6d344bd8724aa1862f4254d8c42b7cc929a797
SHA256356bea8b6e9eb84dfa0dd8674e7c03428c641a47789df605c5bea0730de4aed2
SHA512a12373ec7ec4bac3421363f70cc593f4334b4bb5a5c917e050a45090220fab002c36ba8b03be81159fd70955b4680146c9469e44ddf75a901465d6b1231ee6cd
-
Filesize
5.5MB
MD554850eca0050c5468f712187828655ce
SHA130607a286efe050f9387f3127888b4073595d1a1
SHA25606e1523a9cc9be6bd9d7a33c2720519d1a071747222f044bdf0c4d590a508575
SHA51240d575da0d48f6b0ab7dbeabf68a4b40551157671e34f5669fe2627fe51d8f623e00adcff24df6abf9ea765dd02ffdcca2783b73f617ee0fb1fca1a88f0d4675
-
Filesize
29.4MB
MD5e12749849e6163a054a3da324aab7627
SHA1f366e235d99a86cce07d2a5feabc22c952180865
SHA2568a95fa3205f2a2c554a5e731f6acd6d05e0a8d116273e927c5728ae07d23276a
SHA5129ce30f06c603f4c57ca070b25347a4de84dbf3268227cf52545ca323e67558e2560cd5571dd707b4994a42d8946517e04db5186c865bab95da7f65542202323a
-
Filesize
24B
MD595ecadb6472bf8d2b5e29c19ff7b6aec
SHA1d418d8d05f1cac3547d233744d765c2100c53f26
SHA256922180290a957b2db5cbd885f952df998245de0cbc9c0795a58c93c86f20c530
SHA512c8c31b23989f5392a25d32b2fd1c14c8ad3cdb58117c509ec33ff7a70b3551a5914c0882c593b27ef36e6e96ce86b490d96d9bf5261b9094799ebd874864e3a7
-
Filesize
12B
MD55db92c491778fc426d102a6cdccde39d
SHA1725c01af9d4fe1f53a8f22da3185c6fb0fbfa417
SHA256124a4f8420dae0a5ebf04ce715399de35dbc8817143225113e4f6f05f6c6f524
SHA512ecd97119339b44c8e7eebcbf4604ef40edca13edc5ade502def9b840e477943c401acb2ed420f13c4e9091d00e88639b327924dde2ee60c9abb3c68b09e06214
-
Filesize
83B
MD5a013a807855d864175a73f8db56eaf05
SHA1ccd8405bcfb4d5b83d3aa6b51c56f3707b534e97
SHA25677a3b8cdee01f86f3a7043296253215c4e05fd1b27a836d17c03fee0b3ec2c80
SHA5127eed4b8422b5e63e8bab01365b42cacb8f1c16a70000de22e4e2879ca13d044e1c7a04974c4bb9ebdd7b7ba1eb5f4fb061260662e9216190b7677a843d0360a8
-
Filesize
40B
MD5441cdaca186f101873ef0c671fde2d09
SHA1e35c737a520fa4254718fdd3d93061635ff90948
SHA256277e5de7af35dfcac250238a9fa211a4653c9cec84af371ed0bf5927bcece784
SHA5123410fd95390c1c8095e5b24dac5bfaa7f9cac32b9ad25a06d1b9ff8a8af9aa4400429736f24bff8bfba765995d41990b8f4f3794d30f570accae764c7f59f1bd
-
Filesize
182KB
MD5f0d3d2ae7496e097d8bf80e8c3f60f7d
SHA1dbb1f87c122af623f4b2d25b7062671a9410c8cf
SHA256d7842e89ea0b796d6f0e69bc0109541c632d7107b5ee7a3a8933879c374ed8dd
SHA512b56797757a5d5a3ffc7d2b72fb3d59dafbe462d49ec6e6b3eb8ef8fdb1a0871647c19672015c76ec4155df8fd82d71d7bf138b1fadcb5e63351d818db0e6ff5c
-
Filesize
265KB
MD556beb39a23e0bf6bcebeb4f94eb7f08a
SHA173294d5582ac4fdbc3c6928cf54414cb55a6fa71
SHA25601e9beed0d7443c2b979b60b72780d8df20e79dcfba64f3afe09235147c5bd20
SHA512eb46cb36c12ee549135c5426a9fd94fa4d7e9efe8d6748b0642e42a6f00381aa6f80c6457a9801f16054cbacf27e21cc88e41cf9c9049c082be2c0d403e18b43
-
Filesize
20.1MB
MD510babe225d85f3da58ee8cc260b63793
SHA1900da981ad757c5b8696b71475341c9228e84be9
SHA2568e8bb13fb0d7beb316487ecde8ead5426784cdcdbf8b4d8dd381c6fe8c7d92a0
SHA512d771c4631b607fc447be37d2ee266859dec4e09aa5544559edff2dea6d277ac9a28792ef1d12875c51b48773e155a983633b9f7ad59e14a36fb36de4d7fe9246