Overview
overview
10Static
static
9Botstrap-R...64.zip
windows7-x64
10Botstrap-R...64.zip
windows10-2004-x64
1README.txt
windows7-x64
1README.txt
windows10-2004-x64
1Release.zip
windows7-x64
1Release.zip
windows10-2004-x64
1Release/Bo...er.exe
windows7-x64
10Release/Bo...er.exe
windows10-2004-x64
10Release/au...in.dll
windows7-x64
3Release/au...in.dll
windows10-2004-x64
3Release/lo...v2.dll
windows7-x64
1Release/lo...v2.dll
windows10-2004-x64
1Release/lo...de.ps1
windows7-x64
3Release/lo...de.ps1
windows10-2004-x64
3Release/lo...ng.dll
windows7-x64
1Release/lo...ng.dll
windows10-2004-x64
1Release/lo...ng.dll
windows7-x64
1Release/lo...ng.dll
windows10-2004-x64
1Release/lo...ng.dll
windows7-x64
1Release/lo...ng.dll
windows10-2004-x64
1Release/lo...d.json
windows7-x64
3Release/lo...d.json
windows10-2004-x64
3Release/lo...-1.dll
windows7-x64
1Release/lo...-1.dll
windows10-2004-x64
1Release/ru...er.dll
windows7-x64
1Release/ru...er.dll
windows10-2004-x64
1Release/ru...er.dll
windows7-x64
1Release/ru...er.dll
windows10-2004-x64
1Release/sc...Dex.js
windows7-x64
3Release/sc...Dex.js
windows10-2004-x64
3Release/sc...ve.lua
windows7-x64
3Release/sc...ve.lua
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 11:13
Behavioral task
behavioral1
Sample
Botstrap-Release-x64.zip
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Botstrap-Release-x64.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
README.txt
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
README.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Release.zip
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Release.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Release/Bootstrapper.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Release/Bootstrapper.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Release/autoexec/bin.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Release/autoexec/bin.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Release/locales/libGLESv2.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Release/locales/libGLESv2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Release/locales/locales/de.ps1
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Release/locales/locales/de.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Release/locales/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Release/locales/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Release/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Release/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Release/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
Release/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Release/locales/resources/vk_swiftshader_icd.json
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Release/locales/resources/vk_swiftshader_icd.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Release/locales/resources/vulkan-1.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Release/locales/resources/vulkan-1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Release/runtimes/win-arm64/native/WebView2Loader.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Release/runtimes/win-arm64/native/WebView2Loader.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Release/runtimes/win-x64/native/WebView2Loader.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Release/runtimes/win-x64/native/WebView2Loader.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Release/scripts/Dex.js
Resource
win7-20241023-en
Behavioral task
behavioral30
Sample
Release/scripts/Dex.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Release/scripts/Sine Wave.lua
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
Release/scripts/Sine Wave.lua
Resource
win10v2004-20241007-en
General
-
Target
Release/scripts/Sine Wave.lua
-
Size
1KB
-
MD5
0bbb2aebfadc119226992045dcaa30b4
-
SHA1
6939f7c1f4fa7ac0f81e9dabef32fdb24d120e72
-
SHA256
a5f5aca3ac216ac9040d0425eb52b1465674d8cd79d928474562d9a644ff4f0b
-
SHA512
b433ad6f5d365c58e2260588fae7a3cbecbfe734daff125ce18b6673c629c1b6bccd6142ea49c2c77d57dbe9ab2d02b2897fd2d7c592d524952a62348715bbf8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2360 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2360 AcroRd32.exe 2360 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2884 3056 cmd.exe 31 PID 3056 wrote to memory of 2884 3056 cmd.exe 31 PID 3056 wrote to memory of 2884 3056 cmd.exe 31 PID 2884 wrote to memory of 2360 2884 rundll32.exe 32 PID 2884 wrote to memory of 2360 2884 rundll32.exe 32 PID 2884 wrote to memory of 2360 2884 rundll32.exe 32 PID 2884 wrote to memory of 2360 2884 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Release\scripts\Sine Wave.lua"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Release\scripts\Sine Wave.lua2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Release\scripts\Sine Wave.lua"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2360
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5645aeba7a14a0a41ed46fca13d28601a
SHA18eaeb34272e8298d3d11704f1b1babbf13c4dfab
SHA256d21e953937dd7a77c588defc9b9f3ba55c59d0823d6e540d08803484c886b958
SHA512a6c0fc9939cf0e4fdcf12e11b8aef16823972abb3ade38680a871de9f21ed559bac2c0d834c2b4aadfe7d9d22afd4310777d4205c0198efbbde6c2573ac1c18f