4e7982c1a982141773e2a47f43d0212c6e966457a4f96f7d05f5476d3e18a9af

Analysis

max time kernel
93s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
droidkit-en-setup.exe
Size 19.6MB
Sample241110-dmlqmaxpev
SHA256 4e7982c1a982141773e2a47f43d0212c6e966457a4f96f7d05f5476d3e18a9af
MD5 8635f94c18c6372a4df1001cac67e366
SHA1 c6b35959a3afe487581509ba1853ff93c8e4e5df
SHA512 f633b6c883909e9d56434020520a4a2def688e3b4f39be69279bf443822d331daf685c90308d0985454039e6af8d14d82bc6e00ba7ff0b053923dad35e0a5f6d
SSDEEP 393216:tQ5BRfYlfUtUVISRRAgnu+tqDgfUIsBws6XYbTkrXDTNiDRUGJwPAEWXOO:t4YlfUtUVIS8gnu+tlDYUX3NiDRUGJ24
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	droidkit-en-setup.exe

Loads dropped DLL 8 IoCs

pid	Process
1372	droidkit-en-setup.exe
1372	droidkit-en-setup.exe
1372	droidkit-en-setup.exe
1372	droidkit-en-setup.exe
1372	droidkit-en-setup.exe
1372	droidkit-en-setup.exe
1372	droidkit-en-setup.exe
1372	droidkit-en-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	droidkit-en-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	droidkit-en-setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	droidkit-en-setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 912	1372	droidkit-en-setup.exe	86
PID 1372 wrote to memory of 912	1372	droidkit-en-setup.exe	86
PID 1372 wrote to memory of 912	1372	droidkit-en-setup.exe	86
PID 912 wrote to memory of 5092	912	cmd.exe	88
PID 912 wrote to memory of 5092	912	cmd.exe	88
PID 912 wrote to memory of 5092	912	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\droidkit-en-setup.exe
"C:\Users\Admin\AppData\Local\Temp\droidkit-en-setup.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"A9A1901E\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.3\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\curl.exe
    curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"A9A1901E\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.3\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CheckProVs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\CheckProVs.dll
Size 18KB
SHA256 64e6aad5d6628bc743196a42e28df3f8dc71cdf0d2ad4c250bab872d2a3991c7
MD5 5422e399fabd3a344e8dcc807a48637e
SHA1 59b0830698b15993671eb0dd43020041c351deb8
SHA512 9d102954e0d7bb7e69219a14158e410c18adb85d1cca9e269f3955d3fc5e61b23872313b78d16cd6488eaac0f835b233356152575bf130f8ec91e0d481aa1493
SSDEEP 384:qJqUuDf+bOQNnPV5By6ki2/iAV1/wfT3ir2WSx7bLFMGO:q8UA+bfndbd26H3iPmbLFJO
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleTracingLib.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\GoogleTracingLib.dll
Size 46KB
SHA256 5b8cadf540dd47d19b1020bf5c0aca1b6d14d9d875b0a5794b432401c60ee5c7
MD5 3a914fc853188765010b73ff99834383
SHA1 374b9c4bcc852e42e85aab7b142ecdd80f0c40a1
SHA512 1e1a26dcb480cae7dc0fb89c0e8b560206b23b85a6f56458e2019af9c67ca9f942e2c75e78052e4e0eebcfff5e7a3c5eafb5538ba776c0a40b39cafee0bce0e7
SSDEEP 768:/WXV2fVEC5h9KclMCumc6plPHY4jq7rOZkdhKZVz26e3iPmbLb:zSmh9/BumTlg4kOZ+KzztQ7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\System.dll
Size 22KB
SHA256 3924b57f8993a880d53e1e4e18eb6ba9b5dc610cbb00345c954c7e8a9078c309
MD5 86a488bf743dfab80ff142713adb5d48
SHA1 02e4b39f2fa40cd4edcc42cb524dc3ce911bfdac
SHA512 0ed09bcddd5bd13a91e7b99b78e37a01a36d62a29ad74acaacbe0da6446c8523e83ed2c089d2847e4d1ba467da93e2fd2de104feb51bcda445511b334bf932c8
SSDEEP 384:h8QIl975eXqlWBrz7YLOl6q6ki2/id91/wfT3ir2WSx7bLo0w4I:hgPgrfYLO8F26s3iPmbLVa
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp100.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\msvcp100.dll
Size 593KB
SHA256 934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c
MD5 d029339c0f59cf662094eddf8c42b2b5
SHA1 a0b6de44255ce7bfade9a5b559dd04f2972bfdc8
SHA512 021d9af52e68cb7a3b0042d9ed6c9418552ee16df966f9ccedd458567c47d70471cb8851a69d3982d64571369664faeeae3be90e2e88a909005b9cdb73679c82
SSDEEP 12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\msvcr100.dll
Size 809KB
SHA256 ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5
MD5 366fd6f3a451351b5df2d7c4ecf4c73a
SHA1 50db750522b9630757f91b53df377fd4ed4e2d66
SHA512 2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130
SSDEEP 12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDui.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\nsDui.dll
Size 10.0MB
SHA256 3be54dea5aedc0d8d16d6c4bd4e046e2d93bfc550a1a035a94768c2d5901e327
MD5 368841af8b0074e348418f106716e603
SHA1 75469510665b651b38e3b4fb7c4240722c756126
SHA512 3804afa3930a90f258a2b4e7106e1d0211e5d4ca6a7f5ba23da11e3908b4e202295ddbcb1ecf1e15215bc9a0aece1a46efad07ad94feddd4f316b0de674c50d5
SSDEEP 196608:H1YWSpeHkab9WLMhJuH9E7QfqV9BgtBx2Tr+Z/iYyEuOyWoqeob8VvW:eWBfbQcJudLqV9ByBxP/1o0b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads