Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 08:51
Behavioral task
behavioral1
Sample
Puckyworld bot 3.0.exe
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
General
-
Target
Puckyworld bot 3.0.exe
-
Size
308KB
-
MD5
6077f831936a9266ac627baf0befd079
-
SHA1
f7cf79ae8cbc05d7a3a9fbd71f97f38fd948f85b
-
SHA256
ebc8847a37b40a462151efc0a5ada9e36514b68f595793eafea5b79eb57c1acb
-
SHA512
10d2d2bef290e4040bdf8a6a80ba46700693969ed89ffda0ba035401fcc81cfb06d2d6f118f3a8a72e923ccc961631aa64618a0dac65050305958f9c732bcdc5
-
SSDEEP
6144:SYDhB6ActM8FbPt6a15RGkPNJAcb+k2WzoPiML3AYRYAe5mYklPIn83Rvxr7:19BvctM85t35JPNJj2WzoRLQYRYzmYrs
Malware Config
Signatures
-
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3012-1-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-2-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-3-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-4-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-5-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-6-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-7-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-8-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-9-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-10-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-11-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-12-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-13-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/3012-14-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/3012-0-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-1-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-2-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-3-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-4-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-5-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-6-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-7-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-8-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-9-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-10-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-11-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-12-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-13-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/3012-14-0x0000000000400000-0x00000000004C1000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Puckyworld bot 3.0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3012 Puckyworld bot 3.0.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe 3012 Puckyworld bot 3.0.exe