Overview
overview
5Static
static
5обход...rt.dll
windows7-x64
1обход...rt.dll
windows10-2004-x64
1обход...64.sys
windows10-2004-x64
1обход...n1.dll
windows7-x64
5обход...n1.dll
windows10-2004-x64
5обход...ws.exe
windows7-x64
5обход...ws.exe
windows10-2004-x64
5обход...rd.bat
windows7-x64
5обход...rd.bat
windows10-2004-x64
5обход...al.bat
windows7-x64
5обход...al.bat
windows10-2004-x64
5обход...rd.bat
windows7-x64
1обход...rd.bat
windows10-2004-x64
1обход...al.bat
windows7-x64
1обход...al.bat
windows10-2004-x64
1обход...rd.bat
windows7-x64
1обход...rd.bat
windows10-2004-x64
1обход...ve.bat
windows7-x64
1обход...ve.bat
windows10-2004-x64
1Analysis
-
max time kernel
94s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 15:39
Behavioral task
behavioral1
Sample
обходик — копия/bin/WinDivert.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
обходик — копия/bin/WinDivert.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
обходик — копия/bin/WinDivert64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
обходик — копия/bin/cygwin1.dll
Resource
win7-20241023-en
Behavioral task
behavioral5
Sample
обходик — копия/bin/cygwin1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
обходик — копия/bin/winws.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
обходик — копия/bin/winws.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
обходик — копия/discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
обходик — копия/discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
обходик — копия/general.bat
Resource
win7-20241010-en
Behavioral task
behavioral11
Sample
обходик — копия/general.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
обходик — копия/service_discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
обходик — копия/service_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
обходик — копия/service_general.bat
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
обходик — копия/service_general.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
обходик — копия/service_goodbye_discord.bat
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
обходик — копия/service_goodbye_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
обходик — копия/service_remove.bat
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
обходик — копия/service_remove.bat
Resource
win10v2004-20241007-en
General
-
Target
обходик — копия/general.bat
-
Size
934B
-
MD5
11b20037f9d0d4b056f47ea453ad9928
-
SHA1
27845b54b79af1c75de576df26da93fc6ba378f8
-
SHA256
96cc24a2019ab0c6cbd5b1537a349a2aadea72a699a27029bc6a747c64c5a1b9
-
SHA512
49358447249486700e0c01167ba4b5b60fb65e7667af4e193eba09394193d9ce1420286d56046d50064238bc266db01acf22cfc407e19270ce9442c01dc66ed3
Malware Config
Signatures
-
resource yara_rule behavioral11/memory/2632-0-0x00007FF8C1650000-0x00007FF8C1962000-memory.dmp upx behavioral11/memory/2632-5-0x00007FF8C1650000-0x00007FF8C1962000-memory.dmp upx -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2632 winws.exe Token: SeBackupPrivilege 2632 winws.exe Token: SeDebugPrivilege 2632 winws.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3316 wrote to memory of 2964 3316 cmd.exe 84 PID 3316 wrote to memory of 2964 3316 cmd.exe 84 PID 3316 wrote to memory of 2632 3316 cmd.exe 85 PID 3316 wrote to memory of 2632 3316 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\обходик — копия\general.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\winws.exe"C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\winws.exe" --wf-tcp=80,443 --wf-udp=443,50000-65535 --filter-udp=443 --hostlist="list-general.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-udplen-increment=10 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-cutoff=d3 --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80 --hostlist="list-general.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --new --filter-tcp=443 --hostlist="list-general.txt" --dpi-desync=fake,split --dpi-desync-autottl=2 --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\tls_clienthello_www_google_com.bin"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632
-