Malware Analysis Report

2024-12-07 14:58

Sample ID 241004-hxz38a1apm
Target bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N
SHA256 bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8
Tags
cryptbot discovery exploit spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8

Threat Level: Known bad

The file bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N was found to be: Known bad.

Malicious Activity Summary

cryptbot discovery exploit spyware stealer upx

CryptBot

Possible privilege escalation attempt

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Checks BIOS information in registry

Modifies file permissions

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-04 07:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-04 07:07

Reported

2024-10-04 07:09

Platform

win7-20240903-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe"

Signatures

CryptBot

spyware stealer cryptbot

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\compact.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\bootsect.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\takeown.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\takeown.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1452 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe
PID 1452 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe
PID 1452 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe
PID 1452 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe
PID 1452 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe
PID 1452 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe
PID 1452 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe
PID 1452 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe
PID 2244 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2244 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2244 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2244 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2244 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2244 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2244 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2712 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1176 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1176 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1176 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1176 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2096 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2096 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2096 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2712 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2480 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2480 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2480 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2712 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 960 wrote to memory of 1436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 960 wrote to memory of 1436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 960 wrote to memory of 1436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 960 wrote to memory of 1436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2712 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2124 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2124 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2124 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2712 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\system32\cmd.exe
PID 2520 wrote to memory of 2144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\cscript.exe
PID 2520 wrote to memory of 2144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\cscript.exe
PID 2520 wrote to memory of 2144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\cscript.exe
PID 2712 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe

"C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe"

C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe

"C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe"

C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe"

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "cmd.exe /c takeown /f C:\ldrscan\bootwin"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)"

C:\Windows\SysWOW64\icacls.exe

icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "cmd.exe /c takeown /f C:\ldrscan\bootwin"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)"

C:\Windows\SysWOW64\icacls.exe

icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)

C:\Windows\system32\cmd.exe

cmd.exe /A /C "C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ilc "C:\Acer.XRM-MS""

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ilc "C:\Acer.XRM-MS"

C:\Windows\system32\cmd.exe

cmd.exe /A /C "C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ipk FJGCP-4DFJD-GJY49-VJBQ7-HYRR2"

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ipk FJGCP-4DFJD-GJY49-VJBQ7-HYRR2

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "compact /u \\?\Volume{fc914843-69ed-11ef-8ad4-806e6f6e6963}\MFNDZ"

C:\Windows\SysWOW64\compact.exe

compact /u \\?\Volume{fc914843-69ed-11ef-8ad4-806e6f6e6963}\MFNDZ

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "C:\bootsect.exe /nt60 SYS /force"

C:\bootsect.exe

C:\bootsect.exe /nt60 SYS /force

Network

Country Destination Domain Proto
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp

Files

\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe

MD5 5d6a303668e616ff81485949f18515b3
SHA1 fc7ca4ae06279a78d0e0fcbf7f3a874ff8230cfe
SHA256 d48ac7a7f98179c41d161ab90c08fac46fac8680e10b6f8fa605d5b029839d01
SHA512 49b86188cd9847afb9230cf59e1d29069b37bcaf178d50fb78d64dfe918ec523e140f1ee12f790d1daaa11c1e198f8744b3117683f7c91d637c91c6779a63fd3

memory/1452-32-0x0000000000D60000-0x000000000169F000-memory.dmp

memory/2968-33-0x0000000000400000-0x0000000001065000-memory.dmp

memory/2244-38-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2244-36-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2244-34-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2244-41-0x0000000000030000-0x0000000000031000-memory.dmp

memory/2244-39-0x0000000000030000-0x0000000000031000-memory.dmp

memory/2244-43-0x0000000000030000-0x0000000000031000-memory.dmp

memory/2244-45-0x00000000010D0000-0x00000000020D0000-memory.dmp

\Users\Admin\AppData\Local\Temp\Setup.exe

MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e

memory/2244-51-0x00000000180A0000-0x00000000182C3000-memory.dmp

memory/2712-55-0x0000000000400000-0x0000000000623000-memory.dmp

memory/2712-56-0x0000000000A80000-0x0000000000A93000-memory.dmp

memory/2712-101-0x0000000002100000-0x0000000002110000-memory.dmp

memory/2712-93-0x00000000020F0000-0x0000000002100000-memory.dmp

memory/2712-85-0x00000000020D0000-0x00000000020E1000-memory.dmp

memory/2712-77-0x0000000010000000-0x0000000010021000-memory.dmp

memory/2712-69-0x00000000020B0000-0x00000000020C2000-memory.dmp

memory/2712-64-0x00000000020A0000-0x00000000020B0000-memory.dmp

memory/2244-120-0x00000000180A0000-0x00000000182C3000-memory.dmp

memory/2712-124-0x0000000000400000-0x0000000000623000-memory.dmp

C:\Acer.XRM-MS

MD5 f25832af6a684360950dbb15589de34a
SHA1 17ff1d21005c1695ae3dcbdc3435017c895fff5d
SHA256 266d64637cf12ff961165a018f549ff41002dc59380605b36d65cf1b8127c96f
SHA512 e0cf23351c02f4afa85eedc72a86b9114f539595cbd6bcd220e8b8d70fa6a7379dcd947ea0d59332ba672f36ebda6bd98892d9b6b20eedafc8be168387a3dd5f

\??\Volume{fc914843-69ed-11ef-8ad4-806e6f6e6963}\MFNDZ

MD5 eee8b35f215b21b278d68f4125ae9b79
SHA1 54ccb030eb908819e7bfc9e5d2cb39351ded0fe2
SHA256 9d8bdec22f9447e9f898d2fc46b1680e27e5d9b1b2c7f8e4361c1a2fddfe6e66
SHA512 a4a4384775b01d21ba264e5e691c563821687e263384a51d57a76228fbac95fe8163d487b8343c5f743ee0f7709b1684c97f12f3733225d640d3bd0f66ae4d11

C:\bootsect.exe

MD5 1a6a3e90d931f7902ee475c8607a3f84
SHA1 31cd3a9f9e3168964595267bedf448cd21215e54
SHA256 f3987092a7b67bfdb9d3679ae0894bae611fbabe51f5bb98d37589d10345cbed
SHA512 c04188566f85d4df39f22ec578c658bd5572567004c2f9e6a67d5aeef3011d6b84ffc86c746cc3a32a91d722b7288ca3d869dfbc746a5cdf3d4c417f8fe8ad2d

memory/2712-142-0x0000000000400000-0x0000000000623000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-04 07:07

Reported

2024-10-04 07:09

Platform

win10v2004-20240802-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1300 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe
PID 1300 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe
PID 1300 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe
PID 1300 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe
PID 1300 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe
PID 1300 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe
PID 4240 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 4240 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 4240 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe

"C:\Users\Admin\AppData\Local\Temp\bdbc46f258f283a8b86c94a0f2c9b66c2ff4a35605b836034b27671b4c5974e8N.exe"

C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe

"C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe"

C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsLoader.exe"

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp
US 8.8.8.8:53 forcj4vs.top udp
US 8.8.8.8:53 wrfor4pt.top udp

Files

C:\Users\Admin\AppData\Local\Temp\PDloewpjkG.exe

MD5 5d6a303668e616ff81485949f18515b3
SHA1 fc7ca4ae06279a78d0e0fcbf7f3a874ff8230cfe
SHA256 d48ac7a7f98179c41d161ab90c08fac46fac8680e10b6f8fa605d5b029839d01
SHA512 49b86188cd9847afb9230cf59e1d29069b37bcaf178d50fb78d64dfe918ec523e140f1ee12f790d1daaa11c1e198f8744b3117683f7c91d637c91c6779a63fd3

memory/4240-20-0x00000000005D0000-0x00000000005D1000-memory.dmp

memory/4240-21-0x00000000005E0000-0x00000000005E1000-memory.dmp

memory/4240-22-0x0000000000F60000-0x0000000001F60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Setup.exe

MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e

memory/4224-36-0x0000000000400000-0x0000000000623000-memory.dmp

memory/1300-35-0x00000000005D0000-0x0000000000F0F000-memory.dmp

memory/4224-38-0x0000000002BD0000-0x0000000002BE3000-memory.dmp

memory/4224-51-0x0000000002BF0000-0x0000000002C02000-memory.dmp

memory/4224-46-0x0000000000990000-0x00000000009A0000-memory.dmp

memory/4224-83-0x0000000002F80000-0x0000000002F90000-memory.dmp

memory/4224-91-0x0000000002F90000-0x0000000002FB0000-memory.dmp

memory/4224-75-0x0000000002F70000-0x0000000002F80000-memory.dmp

memory/4224-67-0x0000000002F50000-0x0000000002F61000-memory.dmp

memory/4224-59-0x0000000010000000-0x0000000010021000-memory.dmp

memory/4224-102-0x0000000000400000-0x0000000000623000-memory.dmp