Malware Analysis Report

2025-08-05 17:35

Sample ID 241117-sjalhs1rdz
Target Discord.rar
SHA256 e811decdc0c746351da7e841174ea7a644c287ae1ca177503f0f18930458e4f2
Tags
evasion execution persistence privilege_escalation
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

e811decdc0c746351da7e841174ea7a644c287ae1ca177503f0f18930458e4f2

Threat Level: Likely malicious

The file Discord.rar was found to be: Likely malicious.

Malicious Activity Summary

evasion execution persistence privilege_escalation

Modifies Windows Firewall

Stops running service(s)

Legitimate hosting services abused for malware hosting/C2

Launches sc.exe

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Gathers network information

Suspicious use of WriteProcessMemory

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-17 15:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-17 15:08

Reported

2024-11-17 15:14

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

278s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Prv.exe"

Signatures

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion execution

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 416 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 1228 wrote to memory of 4628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 1228 wrote to memory of 4628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 416 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 3760 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4372 wrote to memory of 3760 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 416 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 536 wrote to memory of 116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 536 wrote to memory of 116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 416 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 1804 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1804 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 416 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 3812 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3812 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 416 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 4252 wrote to memory of 3288 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4252 wrote to memory of 3288 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 416 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 4696 wrote to memory of 3284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4696 wrote to memory of 3284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 416 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 2040 wrote to memory of 2500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2040 wrote to memory of 2500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 416 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 4500 wrote to memory of 4064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 4500 wrote to memory of 4064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 416 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 3500 wrote to memory of 344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3500 wrote to memory of 344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 416 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 1672 wrote to memory of 1104 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1672 wrote to memory of 1104 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 416 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 3896 wrote to memory of 3592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3896 wrote to memory of 3592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 416 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 3176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2888 wrote to memory of 3176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 416 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 3708 wrote to memory of 4864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3708 wrote to memory of 4864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 416 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\Prv.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Prv.exe

"C:\Users\Admin\AppData\Local\Temp\Prv.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ipconfig /flushdns

C:\Windows\system32\ipconfig.exe

ipconfig /flushdns

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Block IP"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall delete rule name="Block IP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c MODE CON COLS=55 LINES=12

C:\Windows\system32\mode.com

MODE CON COLS=55 LINES=12

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1

C:\Windows\system32\sc.exe

sc stop HTTPDebuggerPro

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /IM HTTPDebuggerSvc.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c certutil -hashfile C:\Users\Admin\AppData\Local\Temp\Prv.exe MD5 >> C:\ProgramData\hash.txt

C:\Windows\system32\certutil.exe

certutil -hashfile C:\Users\Admin\AppData\Local\Temp\Prv.exe MD5

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1

C:\Windows\system32\sc.exe

sc stop HTTPDebuggerPro

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /IM HTTPDebuggerSvc.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1

C:\Windows\system32\sc.exe

sc stop HTTPDebuggerPro

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /IM HTTPDebuggerSvc.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1

C:\Windows\system32\sc.exe

sc stop HTTPDebuggerPro

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /IM HTTPDebuggerSvc.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1

C:\Windows\system32\sc.exe

sc stop HTTPDebuggerPro

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /IM HTTPDebuggerSvc.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1

C:\Windows\system32\sc.exe

sc stop HTTPDebuggerPro

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /IM HTTPDebuggerSvc.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c MODE CON COLS=55 LINES=12

C:\Windows\system32\mode.com

MODE CON COLS=55 LINES=12

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 keyauth.win udp
US 104.26.1.5:443 keyauth.win tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 5.1.26.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 127.0.0.1:49752 tcp
N/A 127.0.0.1:49754 tcp
US 104.26.1.5:443 keyauth.win tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 c.pki.goog udp
N/A 127.0.0.1:49760 tcp
N/A 127.0.0.1:49762 tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
N/A 127.0.0.1:49768 tcp
N/A 127.0.0.1:49770 tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 162.159.138.232:443 discord.com tcp
N/A 127.0.0.1:49781 tcp
N/A 127.0.0.1:49783 tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 fd.api.iris.microsoft.com udp
FR 20.199.58.43:443 fd.api.iris.microsoft.com tcp
N/A 127.0.0.1:49789 tcp
N/A 127.0.0.1:49791 tcp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
N/A 127.0.0.1:49796 tcp
N/A 127.0.0.1:49798 tcp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
N/A 127.0.0.1:49801 tcp
N/A 127.0.0.1:49803 tcp
US 162.159.137.232:443 discord.com tcp
N/A 127.0.0.1:49806 tcp
N/A 127.0.0.1:49808 tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
N/A 127.0.0.1:49811 tcp
N/A 127.0.0.1:49813 tcp
US 162.159.137.232:443 discord.com tcp
N/A 127.0.0.1:49816 tcp
N/A 127.0.0.1:49818 tcp
US 162.159.137.232:443 discord.com tcp
N/A 127.0.0.1:49821 tcp
N/A 127.0.0.1:49823 tcp

Files

C:\ProgramData\hash.txt

MD5 06ab8bc670c47033af118b08cdde61be
SHA1 feaa5e7133fa9613f5ab4a7b7e4e3933fae5b749
SHA256 a363e6c0aee24c22dd45ae626196407d4f66c9e5c305f94e706984668739ab10
SHA512 df952cd89af9bb7f8a0154a32324e188453484cfeec30541d8727ff4c9cd8390fbe1b8190ffdbefc0be96680e79fb70146242a639915e69738628a727a70fba7

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-17 15:08

Reported

2024-11-17 15:14

Platform

win10ltsc2021-20241023-en

Max time kernel

188s

Max time network

209s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecureEngineSDK64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecureEngineSDK64.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-17 15:08

Reported

2024-11-17 15:13

Platform

win10ltsc2021-20241023-en

Max time kernel

99s

Max time network

209s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-3-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-3-x64.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A