Overview
overview
8Static
static
7ArgusMonit...up.exe
windows11-21h2-x64
8$PLUGINSDIR/AMIH.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...SC.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3AMBattery.dll
windows11-21h2-x64
7ArgusContr...ce.exe
windows11-21h2-x64
5ArgusMonitor.exe
windows11-21h2-x64
5ArgusNetHandler.exe
windows11-21h2-x64
5GpuControl.exe
windows11-21h2-x64
1HWInit.dll
windows11-21h2-x64
5libusb-1.0.dll
windows11-21h2-x64
3Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-11-2024 06:23
Behavioral task
behavioral1
Sample
ArgusMonitor_Setup.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/AMIH.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
AMBattery.dll
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
ArgusControlService.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
ArgusMonitor.exe
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
ArgusNetHandler.exe
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
GpuControl.exe
Resource
win11-20241023-en
Behavioral task
behavioral12
Sample
HWInit.dll
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
libusb-1.0.dll
Resource
win11-20241007-en
General
-
Target
ArgusMonitor.exe
-
Size
5.3MB
-
MD5
e29761ba789c6b84e4fef48d7ca1f74b
-
SHA1
13e83209c744ee0b25dc10a4d607d2b48f63e12e
-
SHA256
1501a9a6627863f8b373f178486d15f1398e120dca8e7c6c6f681ea9ff98fbf4
-
SHA512
bc7ceb8fbaabf87e701c7c42af77e723213de3b630d652f7c597f28351ff193c87959d52bee16cee1ef4da06c79a32c6c96ada4379c596fc73812e622cd7ec34
-
SSDEEP
98304:p/XDngkagxdNR8jplOSCRLOOpAtroz9AyvbSGTB7ny58zn3HoKccbgtxZ8JokyUc:lXrgka8tam3z9AAltO+z3HFccb1R/xi
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral9/memory/32-0-0x0000000000400000-0x00000000018CD000-memory.dmp upx behavioral9/memory/32-2-0x0000000000400000-0x00000000018CD000-memory.dmp upx behavioral9/memory/32-3-0x0000000000400000-0x00000000018CD000-memory.dmp upx behavioral9/memory/32-4-0x0000000000400000-0x00000000018CD000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ArgusMonitor.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ArgusMonitor.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ArgusMonitor.exepid process 32 ArgusMonitor.exe