Overview
overview
7Static
static
3cache-monk....7.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3natives_blob.js
windows11-21h2-x64
3osmesa.dll
windows11-21h2-x64
3resources/electron.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3swiftshade...GL.dll
windows11-21h2-x64
3swiftshade...v2.dll
windows11-21h2-x64
3CacheMonkey.exe
windows11-21h2-x64
1LICENSES.c...m.html
windows11-21h2-x64
3VkICD_mock_icd.dll
windows11-21h2-x64
1VkLayer_co...on.dll
windows11-21h2-x64
1VkLayer_ob...er.dll
windows11-21h2-x64
1VkLayer_pa...on.dll
windows11-21h2-x64
1VkLayer_threading.dll
windows11-21h2-x64
1VkLayer_un...ts.dll
windows11-21h2-x64
1d3dcompiler_47.dll
windows11-21h2-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
1natives_blob.js
windows11-21h2-x64
3osmesa.dll
windows11-21h2-x64
1resources/electron.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3swiftshade...GL.dll
windows11-21h2-x64
1swiftshade...v2.dll
windows11-21h2-x64
1$PLUGINSDI...ss.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3Uninstall ...ey.exe
windows11-21h2-x64
7Analysis
-
max time kernel
439s -
max time network
444s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-10-2024 18:55
Static task
static1
Behavioral task
behavioral1
Sample
cache-monkey-setup-1.0.7.exe
Resource
win11-20241023-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
natives_blob.js
Resource
win11-20241023-en
Behavioral task
behavioral7
Sample
osmesa.dll
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
resources/electron.js
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
resources/elevate.exe
Resource
win11-20241023-en
Behavioral task
behavioral10
Sample
swiftshader/libEGL.dll
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
swiftshader/libGLESv2.dll
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
CacheMonkey.exe
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
VkICD_mock_icd.dll
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
VkLayer_core_validation.dll
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
VkLayer_object_tracker.dll
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
VkLayer_parameter_validation.dll
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
VkLayer_threading.dll
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
VkLayer_unique_objects.dll
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
d3dcompiler_47.dll
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
ffmpeg.dll
Resource
win11-20241023-en
Behavioral task
behavioral22
Sample
libEGL.dll
Resource
win11-20241023-en
Behavioral task
behavioral23
Sample
libGLESv2.dll
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
natives_blob.js
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
osmesa.dll
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
resources/electron.js
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
swiftshader/libEGL.dll
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
swiftshader/libGLESv2.dll
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
Uninstall CacheMonkey.exe
Resource
win11-20241007-en
General
-
Target
swiftshader/libEGL.dll
-
Size
114KB
-
MD5
6719a302e5ee98c64264ac961c95c9e5
-
SHA1
3969f86ec9469436ea340135a27d340fb2e3cea3
-
SHA256
d1d47f5026e762499da49cfda86cf6aca7c2d9f653f60445911eb31c9ace476f
-
SHA512
0cbe10057a26323e233cbcb5bc231be86cffe0be552756969796b3092a5ec38a09d1c596042d334a17c2d7fc54a95bff18d4a61a9b9ddfe55d0549c99b2ddd52
-
SSDEEP
3072:Nhmt4D7bdooFwVY1WLCHbRoNX3LfUkIW:m+DfGoV1LH+UO
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1052 wrote to memory of 1828 1052 rundll32.exe rundll32.exe PID 1052 wrote to memory of 1828 1052 rundll32.exe rundll32.exe PID 1052 wrote to memory of 1828 1052 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1828