Analysis
-
max time kernel
148s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-12-2024 09:37
Behavioral task
behavioral1
Sample
Downloader.exe
Resource
win11-20241007-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
New Client.exe
Resource
win11-20241007-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
New Client.exe
-
Size
164KB
-
MD5
a422e5226ed43c725560722a2ee75700
-
SHA1
f06f1c3ff313ca5441156bff0b8252ae745bfecf
-
SHA256
af6e0071ee6fb69abca018fd9975cab1680c1d1d8d16864924c0f10db72431f1
-
SHA512
659267c3699744f0a1dd821a27a8452ae377bb37d4251c663a4a777942ba66ec6539f54eb18464b778c3ea2f3d017284306a8ca59d307d094b07dd2a777c8cc9
-
SSDEEP
3072:Z64O/PtrrCkAhs5JKOGY5EOQPwiwXbMLRidIZC1A:Z6IOunwXbMAdMCy
Score
7/10
Malware Config
Signatures
-
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini New Client.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini New Client.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini New Client.exe -
System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe -
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision dw20.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Kills process with taskkill 6 IoCs
pid Process 1912 TASKKILL.exe 3056 TASKKILL.exe 4556 TASKKILL.exe 744 TASKKILL.exe 4272 TASKKILL.exe 3960 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4500 schtasks.exe 548 schtasks.exe 1944 schtasks.exe 3552 schtasks.exe 2780 schtasks.exe 2320 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe 1376 New Client.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1376 New Client.exe Token: SeDebugPrivilege 1912 TASKKILL.exe Token: SeDebugPrivilege 3960 TASKKILL.exe Token: SeRestorePrivilege 4492 dw20.exe Token: SeBackupPrivilege 4492 dw20.exe Token: SeBackupPrivilege 4492 dw20.exe Token: SeBackupPrivilege 4492 dw20.exe Token: SeDebugPrivilege 3056 TASKKILL.exe Token: SeDebugPrivilege 4556 TASKKILL.exe Token: SeDebugPrivilege 1672 New Client.exe Token: SeBackupPrivilege 3660 dw20.exe Token: SeBackupPrivilege 3660 dw20.exe Token: SeDebugPrivilege 1200 New Client.exe Token: SeDebugPrivilege 4272 TASKKILL.exe Token: SeDebugPrivilege 744 TASKKILL.exe Token: SeBackupPrivilege 3596 dw20.exe Token: SeBackupPrivilege 3596 dw20.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1376 wrote to memory of 3136 1376 New Client.exe 77 PID 1376 wrote to memory of 3136 1376 New Client.exe 77 PID 1376 wrote to memory of 3136 1376 New Client.exe 77 PID 1376 wrote to memory of 548 1376 New Client.exe 79 PID 1376 wrote to memory of 548 1376 New Client.exe 79 PID 1376 wrote to memory of 548 1376 New Client.exe 79 PID 1376 wrote to memory of 3960 1376 New Client.exe 81 PID 1376 wrote to memory of 3960 1376 New Client.exe 81 PID 1376 wrote to memory of 3960 1376 New Client.exe 81 PID 1376 wrote to memory of 1912 1376 New Client.exe 82 PID 1376 wrote to memory of 1912 1376 New Client.exe 82 PID 1376 wrote to memory of 1912 1376 New Client.exe 82 PID 1376 wrote to memory of 3612 1376 New Client.exe 86 PID 1376 wrote to memory of 3612 1376 New Client.exe 86 PID 1376 wrote to memory of 3612 1376 New Client.exe 86 PID 1376 wrote to memory of 1944 1376 New Client.exe 88 PID 1376 wrote to memory of 1944 1376 New Client.exe 88 PID 1376 wrote to memory of 1944 1376 New Client.exe 88 PID 1376 wrote to memory of 4492 1376 New Client.exe 90 PID 1376 wrote to memory of 4492 1376 New Client.exe 90 PID 1376 wrote to memory of 4492 1376 New Client.exe 90 PID 1672 wrote to memory of 2344 1672 New Client.exe 93 PID 1672 wrote to memory of 2344 1672 New Client.exe 93 PID 1672 wrote to memory of 2344 1672 New Client.exe 93 PID 1672 wrote to memory of 3552 1672 New Client.exe 95 PID 1672 wrote to memory of 3552 1672 New Client.exe 95 PID 1672 wrote to memory of 3552 1672 New Client.exe 95 PID 1672 wrote to memory of 3056 1672 New Client.exe 97 PID 1672 wrote to memory of 3056 1672 New Client.exe 97 PID 1672 wrote to memory of 3056 1672 New Client.exe 97 PID 1672 wrote to memory of 4556 1672 New Client.exe 99 PID 1672 wrote to memory of 4556 1672 New Client.exe 99 PID 1672 wrote to memory of 4556 1672 New Client.exe 99 PID 1672 wrote to memory of 3876 1672 New Client.exe 101 PID 1672 wrote to memory of 3876 1672 New Client.exe 101 PID 1672 wrote to memory of 3876 1672 New Client.exe 101 PID 1672 wrote to memory of 2780 1672 New Client.exe 103 PID 1672 wrote to memory of 2780 1672 New Client.exe 103 PID 1672 wrote to memory of 2780 1672 New Client.exe 103 PID 1672 wrote to memory of 3660 1672 New Client.exe 105 PID 1672 wrote to memory of 3660 1672 New Client.exe 105 PID 1672 wrote to memory of 3660 1672 New Client.exe 105 PID 1200 wrote to memory of 852 1200 New Client.exe 107 PID 1200 wrote to memory of 852 1200 New Client.exe 107 PID 1200 wrote to memory of 852 1200 New Client.exe 107 PID 1200 wrote to memory of 2320 1200 New Client.exe 109 PID 1200 wrote to memory of 2320 1200 New Client.exe 109 PID 1200 wrote to memory of 2320 1200 New Client.exe 109 PID 1200 wrote to memory of 744 1200 New Client.exe 110 PID 1200 wrote to memory of 744 1200 New Client.exe 110 PID 1200 wrote to memory of 744 1200 New Client.exe 110 PID 1200 wrote to memory of 4272 1200 New Client.exe 112 PID 1200 wrote to memory of 4272 1200 New Client.exe 112 PID 1200 wrote to memory of 4272 1200 New Client.exe 112 PID 1200 wrote to memory of 4496 1200 New Client.exe 115 PID 1200 wrote to memory of 4496 1200 New Client.exe 115 PID 1200 wrote to memory of 4496 1200 New Client.exe 115 PID 1200 wrote to memory of 4500 1200 New Client.exe 117 PID 1200 wrote to memory of 4500 1200 New Client.exe 117 PID 1200 wrote to memory of 4500 1200 New Client.exe 117 PID 1200 wrote to memory of 3596 1200 New Client.exe 119 PID 1200 wrote to memory of 3596 1200 New Client.exe 119 PID 1200 wrote to memory of 3596 1200 New Client.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:3136
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:548
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:3612
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1944
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 13362⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2344
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3552
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:3876
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2780
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 10722⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:852
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2320
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:744
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:4496
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4500
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 10642⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3596
-