Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 10:03

General

  • Target

    AndroidSideloader v2.29.2.exe

  • Size

    4.1MB

  • MD5

    b7fa8a83dd1c92d93679c58d06691369

  • SHA1

    0cff7bb71ff43ee92172f30566d8ee1b043129fc

  • SHA256

    6cf2bcdb1a463fc69eddb125eba8cc12854ee23effcd7c65b968667c668a7f0b

  • SHA512

    d74f8450f1fda260d0176ceba347bde6ad58b24a09eaac3cc921e20236a11707cab2f5eaee3bb10907c387d67efbcb66d823ae052b1317f3e953c4984a2b94b8

  • SSDEEP

    24576:JUjV//Ppn/JcDJ7bdukqjVnlqud+/2P+AXg:S5//Rn/QJ7bYkqXfd+/9AQ

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 16 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AndroidSideloader v2.29.2.exe
    "C:\Users\Admin\AppData\Local\Temp\AndroidSideloader v2.29.2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Users\Admin\AppData\Local\Temp\7z.exe
      "7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dependencies.7z" -y -o"C:\RSL\platform-tools" -bsp1
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Users\Admin\AppData\Local\Temp\7z.exe
      "7z.exe" x "C:\Users\Admin\AppData\Local\Temp\rclone.zip" -y -o"C:\Users\Admin\AppData\Local\Temp" -bsp1
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:416
    • C:\RSL\platform-tools\adb.exe
      "C:\RSL\platform-tools\adb.exe" kill-server
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2188
    • C:\RSL\platform-tools\adb.exe
      "C:\RSL\platform-tools\adb.exe" start-server
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\RSL\platform-tools\adb.exe
        adb -L tcp:5037 fork-server server --reply-fd 564
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3900
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" listremotes --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1400
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" sync ":http:/meta.7z" "C:\Users\Admin\AppData\Local\Temp" --http-url https://theapp.vrrookie.xyz/ --tpslimit 1.0 --tpslimit-burst 3
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2040
    • C:\Users\Admin\AppData\Local\Temp\7z.exe
      "7z.exe" x "C:\Users\Admin\AppData\Local\Temp\meta.7z" -y -o"C:\Users\Admin\AppData\Local\Temp\meta" -p"gL59VfgPxoHR" -bsp1
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:416
    • C:\RSL\platform-tools\adb.exe
      "C:\RSL\platform-tools\adb.exe" devices
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4456
    • C:\RSL\platform-tools\adb.exe
      "C:\RSL\platform-tools\adb.exe" shell dumpsys battery
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3284
    • C:\RSL\platform-tools\adb.exe
      "C:\RSL\platform-tools\adb.exe" shell df
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3856
    • C:\RSL\platform-tools\adb.exe
      "C:\RSL\platform-tools\adb.exe" shell pm list packages -3
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:820
    • C:\RSL\platform-tools\adb.exe
      "C:\RSL\platform-tools\adb.exe" shell df
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1184
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3840,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
    1⤵
      PID:2300

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\RSL\platform-tools\AdbWinApi.dll

      Filesize

      105KB

      MD5

      d79a7c0a425f768fc9f9bcf2aa144d8f

      SHA1

      3da9e4c4566bd6d4efeeaf7ceab9e9e83f2f67e5

      SHA256

      1ad523231de449af3ba0e8664d3af332f0c5cc4f09141691ca05e35368fa811a

      SHA512

      ff650b98ecc55df6c2cb1b22221b1e71d63c01324f8a8b0f05f1497f5416131f7c33ef2ea17ed323cb2bfdbe7ae1824474544434899d2cb89e9c8c00db7dbb15

    • C:\RSL\platform-tools\AdbWinUsbApi.dll

      Filesize

      71KB

      MD5

      e6e1716f53624aff7dbce5891334669a

      SHA1

      9c17f50ba4c8e5db9c1118d164995379f8d686fb

      SHA256

      51a61758a6f1f13dd36530199c0d65e227cd9d43765372b2942944cc3296ca2c

      SHA512

      c47392b6f7d701e78f78e0b0ddce5508ab8d247a4095391e77cd665e955f4938e412ffcb6076534dcad287af4f78d84668496935e71b9bb46a98401522815eb9

    • C:\RSL\platform-tools\adb.exe

      Filesize

      5.6MB

      MD5

      64daf7cca61d468d26a407d79a7c26a9

      SHA1

      51b451089e73c9a03e2f24ab2fc81896d48c6126

      SHA256

      997324a38d89e3b282306bf25ccaa167c49a35850ac0ab4a169e7a15afa82fc8

      SHA512

      5a7bd06326e8ee868a2e6c724bc74bd290acaa00f3442807d3f69489a374a13a3cb41fbaf929c79525bdac319bd9a64ecfaf3cbdb6585ae332a485e911d8370d

    • C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\14rcc52w.newcfg

      Filesize

      3KB

      MD5

      db7b16ffbb25211d160392fdacde8566

      SHA1

      e3476ddbef02d584c7ee74b689dc7ecb93107b17

      SHA256

      2b05a9392e60847ca07d051246d2316dc9033b093b59268754c961718a02a57e

      SHA512

      49cd43a958776101b204f860a1c529106d63aae904a8ad3ca45ff1e5fb026870f26c4c86b2ce65bac43e91647d5e3f426b68f9fe78928a9996930232259298e1

    • C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\5qcg4ynk.newcfg

      Filesize

      3KB

      MD5

      9f8aed9db939604d4c54ea80dbd195d4

      SHA1

      92be91bb080e966f57b1e3e72c052ced96686891

      SHA256

      c9af9aeaad19dcdb336407fd389e3875900973eac0c2ee64e6a81ee336894eb0

      SHA512

      a1732807e9b7ecc0632c2a296a71a130fb5846c888733e73ff63ef50ad848ad69b094757e6f808891f42a60cd4d94b63a00542604c9706ecc204a250e2f9bb60

    • C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\cwiuaq20.newcfg

      Filesize

      2KB

      MD5

      e6b27200893811d37b7a7cd50ff6d62d

      SHA1

      ce44ab2b3699c887887858073dd60f95393ddee8

      SHA256

      9fac8fcfa6adda234baf8c866402fc513b98344a445c1b699542c3cb5082b763

      SHA512

      e22597deb03ad2ae725cbfba5e7cb043f941b4e920839ab6349d04eb6126c7d8bb52aa47834e24566cb63c2642ff5661ff7e2add3300a6553ce66da238f015a2

    • C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\m5dnh1na.newcfg

      Filesize

      2KB

      MD5

      145bdfb757a5d571d8dc1e017a24100b

      SHA1

      3a08a3412bd2d386330a1378d32cb4803b9c3886

      SHA256

      043460e55832ac4bb0c9f944ca62f8bd88f6e6b00a657e085a56460b520da8ed

      SHA512

      f7c7d2140251e7b6c9ed9629beeeb40fa119c3a452d8eec82f95915d2f6000247812b3999af82b8ecfa5b9f80d39016636deaf1ba3e130a4002d5506a8d2503b

    • C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\nq32dp1e.newcfg

      Filesize

      3KB

      MD5

      83e180872cadcc0d352b6b503b36815a

      SHA1

      6ab2ccb6deadbde592f32bfc9b54918a5d6a98c2

      SHA256

      7e06583a4e11a32db854666366eb59d9bd4584973af4869c877d760e0de44228

      SHA512

      24d160787bec36c8572f505cf066170cf9952079af7f1964209f558bd9db940587f92156d40a152d57d48f45690f4cf7944afc16858cba0026f2d1cb57e5c73c

    • C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\rdph0sky.newcfg

      Filesize

      2KB

      MD5

      ce838d9dac79df0410518d0706e46246

      SHA1

      0cb1adc31dbebd148d92042dcc0b6d6146cbe7ed

      SHA256

      b0b4b2d2ddf45a92f76a115072b94fe8c1ab682a90323af2d72c34f52d9556ec

      SHA512

      0e01ed5556a468e024d30589de1071293ed19f19a1f7be8a981b1640391089c4cff93125eca4501fedfbd2c5f1caaafaa779626bfe7f87add364b4eb31197f63

    • C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\user.config

      Filesize

      838B

      MD5

      6dc22626c68e39d1f7a92bc247d064fa

      SHA1

      06d72094b8ccfb2cd09e3b04fa79cd2f4efbb40c

      SHA256

      5b1cfb327e8e4f605cdb650526ab442cc846ce97cfdc51d1da23dfecb3abdf60

      SHA512

      09858fce9752da51c915859873510c5f115b8d2b2ffa9b3bfe8bee20b804de1fe3ef8bbe5448b2374d6089af29e9d7914e0098df675e5eef240d4f1649a0db72

    • C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader_v2.29.2_Url_yoqfpljawlmuvev2xykf0ju0t0p31uqo\2.0.0.0\user.config

      Filesize

      2KB

      MD5

      b8852b5108f38932eecf8cab9f361c41

      SHA1

      f0ffe6adcb109bc44311049e3dd1de24f4dccac0

      SHA256

      c03c95474e70631b58482e0f7f0665f8f41b29032bffa4848e356971623519e8

      SHA512

      09b05d210b1fde224ce310cec507635b4400742925f772c914b3028b7c845eafadabac2cf5ff3a92d3945d6cb29b17b8ff225a801435eb7466783c901853bd73

    • C:\Users\Admin\AppData\Local\Temp\7z.exe

      Filesize

      1.2MB

      MD5

      1a7eaa1dab7867e15d7800ae0b5af5e3

      SHA1

      9e6d344bd8724aa1862f4254d8c42b7cc929a797

      SHA256

      356bea8b6e9eb84dfa0dd8674e7c03428c641a47789df605c5bea0730de4aed2

      SHA512

      a12373ec7ec4bac3421363f70cc593f4334b4bb5a5c917e050a45090220fab002c36ba8b03be81159fd70955b4680146c9469e44ddf75a901465d6b1231ee6cd

    • C:\Users\Admin\AppData\Local\Temp\dependencies.7z

      Filesize

      5.5MB

      MD5

      54850eca0050c5468f712187828655ce

      SHA1

      30607a286efe050f9387f3127888b4073595d1a1

      SHA256

      06e1523a9cc9be6bd9d7a33c2720519d1a071747222f044bdf0c4d590a508575

      SHA512

      40d575da0d48f6b0ab7dbeabf68a4b40551157671e34f5669fe2627fe51d8f623e00adcff24df6abf9ea765dd02ffdcca2783b73f617ee0fb1fca1a88f0d4675

    • C:\Users\Admin\AppData\Local\Temp\meta.7z

      Filesize

      29.4MB

      MD5

      e12749849e6163a054a3da324aab7627

      SHA1

      f366e235d99a86cce07d2a5feabc22c952180865

      SHA256

      8a95fa3205f2a2c554a5e731f6acd6d05e0a8d116273e927c5728ae07d23276a

      SHA512

      9ce30f06c603f4c57ca070b25347a4de84dbf3268227cf52545ca323e67558e2560cd5571dd707b4994a42d8946517e04db5186c865bab95da7f65542202323a

    • C:\Users\Admin\AppData\Local\Temp\meta\.meta\notes\Fix-it Ralph VR v2+2 -ByteUs.txt

      Filesize

      24B

      MD5

      95ecadb6472bf8d2b5e29c19ff7b6aec

      SHA1

      d418d8d05f1cac3547d233744d765c2100c53f26

      SHA256

      922180290a957b2db5cbd885f952df998245de0cbc9c0795a58c93c86f20c530

      SHA512

      c8c31b23989f5392a25d32b2fd1c14c8ad3cdb58117c509ec33ff7a70b3551a5914c0882c593b27ef36e6e96ce86b490d96d9bf5261b9094799ebd874864e3a7

    • C:\Users\Admin\AppData\Local\Temp\meta\.meta\notes\ForeVR Pool v926+2.0.926 -NIF.txt

      Filesize

      12B

      MD5

      5db92c491778fc426d102a6cdccde39d

      SHA1

      725c01af9d4fe1f53a8f22da3185c6fb0fbfa417

      SHA256

      124a4f8420dae0a5ebf04ce715399de35dbc8817143225113e4f6f05f6c6f524

      SHA512

      ecd97119339b44c8e7eebcbf4604ef40edca13edc5ade502def9b840e477943c401acb2ed420f13c4e9091d00e88639b327924dde2ee60c9abb3c68b09e06214

    • C:\Users\Admin\AppData\Local\Temp\meta\.meta\notes\Game Night v28+0.2.25 -VRP.txt

      Filesize

      83B

      MD5

      a013a807855d864175a73f8db56eaf05

      SHA1

      ccd8405bcfb4d5b83d3aa6b51c56f3707b534e97

      SHA256

      77a3b8cdee01f86f3a7043296253215c4e05fd1b27a836d17c03fee0b3ec2c80

      SHA512

      7eed4b8422b5e63e8bab01365b42cacb8f1c16a70000de22e4e2879ca13d044e1c7a04974c4bb9ebdd7b7ba1eb5f4fb061260662e9216190b7677a843d0360a8

    • C:\Users\Admin\AppData\Local\Temp\meta\.meta\notes\XRWorkout v15066+1.1b -VRP.txt

      Filesize

      40B

      MD5

      441cdaca186f101873ef0c671fde2d09

      SHA1

      e35c737a520fa4254718fdd3d93061635ff90948

      SHA256

      277e5de7af35dfcac250238a9fa211a4653c9cec84af371ed0bf5927bcece784

      SHA512

      3410fd95390c1c8095e5b24dac5bfaa7f9cac32b9ad25a06d1b9ff8a8af9aa4400429736f24bff8bfba765995d41990b8f4f3794d30f570accae764c7f59f1bd

    • C:\Users\Admin\AppData\Local\Temp\meta\VRP-GameList.txt

      Filesize

      182KB

      MD5

      f0d3d2ae7496e097d8bf80e8c3f60f7d

      SHA1

      dbb1f87c122af623f4b2d25b7062671a9410c8cf

      SHA256

      d7842e89ea0b796d6f0e69bc0109541c632d7107b5ee7a3a8933879c374ed8dd

      SHA512

      b56797757a5d5a3ffc7d2b72fb3d59dafbe462d49ec6e6b3eb8ef8fdb1a0871647c19672015c76ec4155df8fd82d71d7bf138b1fadcb5e63351d818db0e6ff5c

    • C:\Users\Admin\AppData\Local\Temp\nouns\blacklist.txt

      Filesize

      265KB

      MD5

      56beb39a23e0bf6bcebeb4f94eb7f08a

      SHA1

      73294d5582ac4fdbc3c6928cf54414cb55a6fa71

      SHA256

      01e9beed0d7443c2b979b60b72780d8df20e79dcfba64f3afe09235147c5bd20

      SHA512

      eb46cb36c12ee549135c5426a9fd94fa4d7e9efe8d6748b0642e42a6f00381aa6f80c6457a9801f16054cbacf27e21cc88e41cf9c9049c082be2c0d403e18b43

    • C:\Users\Admin\AppData\Local\Temp\rclone.zip

      Filesize

      20.1MB

      MD5

      10babe225d85f3da58ee8cc260b63793

      SHA1

      900da981ad757c5b8696b71475341c9228e84be9

      SHA256

      8e8bb13fb0d7beb316487ecde8ead5426784cdcdbf8b4d8dd381c6fe8c7d92a0

      SHA512

      d771c4631b607fc447be37d2ee266859dec4e09aa5544559edff2dea6d277ac9a28792ef1d12875c51b48773e155a983633b9f7ad59e14a36fb36de4d7fe9246

    • memory/2132-81-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2132-82-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2132-0-0x0000000074F0E000-0x0000000074F0F000-memory.dmp

      Filesize

      4KB

    • memory/2132-80-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2132-79-0x0000000074F0E000-0x0000000074F0F000-memory.dmp

      Filesize

      4KB

    • memory/2132-36-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2132-168-0x0000000001990000-0x0000000001A42000-memory.dmp

      Filesize

      712KB

    • memory/2132-171-0x0000000001AB0000-0x0000000001AD2000-memory.dmp

      Filesize

      136KB

    • memory/2132-172-0x0000000008FE0000-0x0000000009334000-memory.dmp

      Filesize

      3.3MB

    • memory/2132-35-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2132-8-0x0000000005B90000-0x0000000005B9C000-memory.dmp

      Filesize

      48KB

    • memory/2132-9-0x0000000005ED0000-0x0000000005EDE000-memory.dmp

      Filesize

      56KB

    • memory/2132-10-0x0000000005F20000-0x0000000005FAE000-memory.dmp

      Filesize

      568KB

    • memory/2132-7-0x0000000005B80000-0x0000000005B8A000-memory.dmp

      Filesize

      40KB

    • memory/2132-6-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2132-3-0x0000000005BD0000-0x0000000005C62000-memory.dmp

      Filesize

      584KB

    • memory/2132-2-0x0000000006180000-0x0000000006724000-memory.dmp

      Filesize

      5.6MB

    • memory/2132-1-0x0000000000E30000-0x0000000001252000-memory.dmp

      Filesize

      4.1MB