Overview
overview
7Static
static
3Wave-Setup.exe
windows7-x64
7Wave-Setup.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
1$PLUGINSDIR/app-64.7z
windows10-2004-x64
1resources/...mon.js
ubuntu-18.04-amd64
3resources/...mon.js
debian-9-armhf
4resources/...mon.js
debian-9-mips
3resources/...mon.js
debian-9-mipsel
3resources/...ll.exe
windows7-x64
1resources/...ll.exe
windows10-2004-x64
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...rse.js
windows7-x64
3resources/...rse.js
windows10-2004-x64
3resources/...and.js
windows7-x64
3resources/...and.js
windows10-2004-x64
3resources/...lts.js
windows7-x64
3resources/...lts.js
windows10-2004-x64
3resources/...xec.js
windows7-x64
3resources/...xec.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...oad.js
windows7-x64
3resources/...oad.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/10/2024, 23:44
Static task
static1
Behavioral task
behavioral1
Sample
Wave-Setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Wave-Setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral12
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral13
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral14
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/help/index.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/help/index.js
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/app-64.7z
-
Size
124.9MB
-
MD5
3f010ffa978ac9d2c32fb4739d992ac2
-
SHA1
d5d57349fd60a7755a5e4c20b4014d297d87bab5
-
SHA256
d0c63caa388d0ea482fe7b130aa05bb22607bebc4b4ce56674879cffddadc1e1
-
SHA512
468f757215e9d6255a77009590fa97bcd71778adc9bbbb389c564c50a776eb3dbc3411e13e04868f26f2c999c9d541c5f3320ae6caafe82836c72627fe6695f8
-
SSDEEP
3145728:pJkrYtrL1bASyAPgdg3ib33ohJH69WfKNZLZM+tpR5zRv:7kr0L1USyANib33ovaNZLJ5J
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4320 7zFM.exe Token: 35 4320 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4320 7zFM.exe