Overview
overview
5Static
static
5обход...rt.dll
windows7-x64
1обход...rt.dll
windows10-2004-x64
1обход...64.sys
windows10-2004-x64
1обход...n1.dll
windows7-x64
5обход...n1.dll
windows10-2004-x64
5обход...ws.exe
windows7-x64
5обход...ws.exe
windows10-2004-x64
5обход...rd.bat
windows7-x64
5обход...rd.bat
windows10-2004-x64
5обход...al.bat
windows7-x64
5обход...al.bat
windows10-2004-x64
5обход...rd.bat
windows7-x64
1обход...rd.bat
windows10-2004-x64
1обход...al.bat
windows7-x64
1обход...al.bat
windows10-2004-x64
1обход...rd.bat
windows7-x64
1обход...rd.bat
windows10-2004-x64
1обход...ve.bat
windows7-x64
1обход...ve.bat
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 15:39
Behavioral task
behavioral1
Sample
обходик — копия/bin/WinDivert.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
обходик — копия/bin/WinDivert.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
обходик — копия/bin/WinDivert64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
обходик — копия/bin/cygwin1.dll
Resource
win7-20241023-en
Behavioral task
behavioral5
Sample
обходик — копия/bin/cygwin1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
обходик — копия/bin/winws.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
обходик — копия/bin/winws.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
обходик — копия/discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
обходик — копия/discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
обходик — копия/general.bat
Resource
win7-20241010-en
Behavioral task
behavioral11
Sample
обходик — копия/general.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
обходик — копия/service_discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
обходик — копия/service_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
обходик — копия/service_general.bat
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
обходик — копия/service_general.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
обходик — копия/service_goodbye_discord.bat
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
обходик — копия/service_goodbye_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
обходик — копия/service_remove.bat
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
обходик — копия/service_remove.bat
Resource
win10v2004-20241007-en
General
-
Target
обходик — копия/discord.bat
-
Size
800B
-
MD5
9734ab093d3e4835d5098c734cbc5692
-
SHA1
19e8ef6ebf057df2261588b962426fdc1522edcf
-
SHA256
e824798d4e56f6de50632932c3316d4b5cd8f05ef831a0ca3db00c142b788796
-
SHA512
77d9b57e6c4680bc6aeaae72af79c69487077643ad3c53a8ee983bdf334945403db7a834de1b996235f35633bd8407f6d5918c743c469c1bb4671e116266265d
Malware Config
Signatures
-
resource yara_rule behavioral9/memory/4024-0-0x00007FFEC9D70000-0x00007FFECA082000-memory.dmp upx behavioral9/memory/4024-5-0x00007FFEC9D70000-0x00007FFECA082000-memory.dmp upx -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 4024 winws.exe Token: SeBackupPrivilege 4024 winws.exe Token: SeDebugPrivilege 4024 winws.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 3924 1740 cmd.exe 84 PID 1740 wrote to memory of 3924 1740 cmd.exe 84 PID 1740 wrote to memory of 4024 1740 cmd.exe 85 PID 1740 wrote to memory of 4024 1740 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\обходик — копия\discord.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:3924
-
-
C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\winws.exe"C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\winws.exe" --wf-tcp=443 --wf-udp=443,50000-65535 --filter-udp=443 --hostlist="list-discord.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-udplen-increment=10 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-cutoff=d3 --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\quic_initial_www_google_com.bin" --new --filter-tcp=443 --hostlist="list-discord.txt" --dpi-desync=fake,split --dpi-desync-autottl=2 --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\обходик — копия\bin\tls_clienthello_www_google_com.bin"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4024
-