Overview
overview
5Static
static
5обход...rt.dll
windows7-x64
1обход...rt.dll
windows10-2004-x64
1обход...64.sys
windows10-2004-x64
1обход...n1.dll
windows7-x64
5обход...n1.dll
windows10-2004-x64
5обход...ws.exe
windows7-x64
5обход...ws.exe
windows10-2004-x64
5обход...rd.bat
windows7-x64
5обход...rd.bat
windows10-2004-x64
5обход...al.bat
windows7-x64
5обход...al.bat
windows10-2004-x64
5обход...rd.bat
windows7-x64
1обход...rd.bat
windows10-2004-x64
1обход...al.bat
windows7-x64
1обход...al.bat
windows10-2004-x64
1обход...rd.bat
windows7-x64
1обход...rd.bat
windows10-2004-x64
1обход...ve.bat
windows7-x64
1обход...ve.bat
windows10-2004-x64
1Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 15:39
Behavioral task
behavioral1
Sample
обходик — копия/bin/WinDivert.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
обходик — копия/bin/WinDivert.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
обходик — копия/bin/WinDivert64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
обходик — копия/bin/cygwin1.dll
Resource
win7-20241023-en
Behavioral task
behavioral5
Sample
обходик — копия/bin/cygwin1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
обходик — копия/bin/winws.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
обходик — копия/bin/winws.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
обходик — копия/discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
обходик — копия/discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
обходик — копия/general.bat
Resource
win7-20241010-en
Behavioral task
behavioral11
Sample
обходик — копия/general.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
обходик — копия/service_discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
обходик — копия/service_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
обходик — копия/service_general.bat
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
обходик — копия/service_general.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
обходик — копия/service_goodbye_discord.bat
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
обходик — копия/service_goodbye_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
обходик — копия/service_remove.bat
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
обходик — копия/service_remove.bat
Resource
win10v2004-20241007-en
General
-
Target
обходик — копия/general.bat
-
Size
934B
-
MD5
11b20037f9d0d4b056f47ea453ad9928
-
SHA1
27845b54b79af1c75de576df26da93fc6ba378f8
-
SHA256
96cc24a2019ab0c6cbd5b1537a349a2aadea72a699a27029bc6a747c64c5a1b9
-
SHA512
49358447249486700e0c01167ba4b5b60fb65e7667af4e193eba09394193d9ce1420286d56046d50064238bc266db01acf22cfc407e19270ce9442c01dc66ed3
Malware Config
Signatures
-
resource yara_rule behavioral10/memory/1740-0-0x000007FEF6B80000-0x000007FEF6E92000-memory.dmp upx behavioral10/memory/1740-5-0x000007FEF6B80000-0x000007FEF6E92000-memory.dmp upx -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 460 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1740 winws.exe Token: SeBackupPrivilege 1740 winws.exe Token: SeDebugPrivilege 1740 winws.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2028 2220 cmd.exe 30 PID 2220 wrote to memory of 2028 2220 cmd.exe 30 PID 2220 wrote to memory of 2028 2220 cmd.exe 30 PID 2220 wrote to memory of 1740 2220 cmd.exe 31 PID 2220 wrote to memory of 1740 2220 cmd.exe 31 PID 2220 wrote to memory of 1740 2220 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\обходик — копия\general.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\winws.exe"C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\winws.exe" --wf-tcp=80,443 --wf-udp=443,50000-65535 --filter-udp=443 --hostlist="list-general.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-udplen-increment=10 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-cutoff=d3 --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80 --hostlist="list-general.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --new --filter-tcp=443 --hostlist="list-general.txt" --dpi-desync=fake,split --dpi-desync-autottl=2 --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\tls_clienthello_www_google_com.bin"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740
-