goproxy | 18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/03/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe
Size 6.3MB
Sample260305-c77m6aa16v
SHA256 18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac
MD5 099af1801af303b540e3db14db63ecf5
SHA1 3e79adece2bc82b69fbff64c7993c6aa6ab0bb69
SHA512 032cc890ad0402af5ddc8f2c52e3affd40e76c1c0762b94ba4d406fe3f286d9f1a1569611a914c4be6cbe6ce49c5ef3934f7396ed99ad641c661349c619edabb
SSDEEP 49152:Tcx3rMFn9+nnRF08JhnEoVg5iYK6tC8ggFiGITVN/jZOoj4n9f5KkqfKiK9Kv55c:TsckZVmKP8ggIGIDdgpFqb7Ep
TLSH
T17D664B43ECA155E9C0BAD2318A639362BB717C485B3123D72B90F7282F76BD06E79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor goproxy persistence

Malware Config

Signatures

Detects GoProxy payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b3a2-1.dat	family_goproxy

GoProxy
GoProxy is a proxy malware written in Golang.
backdoor goproxy
Goproxy family
goproxy

Executes dropped EXE 2 IoCs

pid	Process
2160	obs.exe
1436	obs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	5	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3372	18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe
3372	18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe
2160	obs.exe
2160	obs.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3808	WMIC.exe
Token: SeSecurityPrivilege	3808	WMIC.exe
Token: SeTakeOwnershipPrivilege	3808	WMIC.exe
Token: SeLoadDriverPrivilege	3808	WMIC.exe
Token: SeSystemProfilePrivilege	3808	WMIC.exe
Token: SeSystemtimePrivilege	3808	WMIC.exe
Token: SeProfSingleProcessPrivilege	3808	WMIC.exe
Token: SeIncBasePriorityPrivilege	3808	WMIC.exe
Token: SeCreatePagefilePrivilege	3808	WMIC.exe
Token: SeBackupPrivilege	3808	WMIC.exe
Token: SeRestorePrivilege	3808	WMIC.exe
Token: SeShutdownPrivilege	3808	WMIC.exe
Token: SeDebugPrivilege	3808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3808	WMIC.exe
Token: SeRemoteShutdownPrivilege	3808	WMIC.exe
Token: SeUndockPrivilege	3808	WMIC.exe
Token: SeManageVolumePrivilege	3808	WMIC.exe
Token: 33	3808	WMIC.exe
Token: 34	3808	WMIC.exe
Token: 35	3808	WMIC.exe
Token: 36	3808	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3808	WMIC.exe
Token: SeSecurityPrivilege	3808	WMIC.exe
Token: SeTakeOwnershipPrivilege	3808	WMIC.exe
Token: SeLoadDriverPrivilege	3808	WMIC.exe
Token: SeSystemProfilePrivilege	3808	WMIC.exe
Token: SeSystemtimePrivilege	3808	WMIC.exe
Token: SeProfSingleProcessPrivilege	3808	WMIC.exe
Token: SeIncBasePriorityPrivilege	3808	WMIC.exe
Token: SeCreatePagefilePrivilege	3808	WMIC.exe
Token: SeBackupPrivilege	3808	WMIC.exe
Token: SeRestorePrivilege	3808	WMIC.exe
Token: SeShutdownPrivilege	3808	WMIC.exe
Token: SeDebugPrivilege	3808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3808	WMIC.exe
Token: SeRemoteShutdownPrivilege	3808	WMIC.exe
Token: SeUndockPrivilege	3808	WMIC.exe
Token: SeManageVolumePrivilege	3808	WMIC.exe
Token: 33	3808	WMIC.exe
Token: 34	3808	WMIC.exe
Token: 35	3808	WMIC.exe
Token: 36	3808	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4908	WMIC.exe
Token: SeSecurityPrivilege	4908	WMIC.exe
Token: SeTakeOwnershipPrivilege	4908	WMIC.exe
Token: SeLoadDriverPrivilege	4908	WMIC.exe
Token: SeSystemProfilePrivilege	4908	WMIC.exe
Token: SeSystemtimePrivilege	4908	WMIC.exe
Token: SeProfSingleProcessPrivilege	4908	WMIC.exe
Token: SeIncBasePriorityPrivilege	4908	WMIC.exe
Token: SeCreatePagefilePrivilege	4908	WMIC.exe
Token: SeBackupPrivilege	4908	WMIC.exe
Token: SeRestorePrivilege	4908	WMIC.exe
Token: SeShutdownPrivilege	4908	WMIC.exe
Token: SeDebugPrivilege	4908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4908	WMIC.exe
Token: SeRemoteShutdownPrivilege	4908	WMIC.exe
Token: SeUndockPrivilege	4908	WMIC.exe
Token: SeManageVolumePrivilege	4908	WMIC.exe
Token: 33	4908	WMIC.exe
Token: 34	4908	WMIC.exe
Token: 35	4908	WMIC.exe
Token: 36	4908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4908	WMIC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3684	3372	18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe	79
PID 3684 wrote to memory of 3808	3684	CMD.exe	81
PID 3372 wrote to memory of 4960	3372	18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe	83
PID 4960 wrote to memory of 4908	4960	CMD.exe	85
PID 3372 wrote to memory of 5596	3372	18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe	86
PID 5596 wrote to memory of 3396	5596	CMD.exe	88
PID 3372 wrote to memory of 5508	3372	18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe	89
PID 2160 wrote to memory of 1172	2160	obs.exe	92
PID 1172 wrote to memory of 3872	1172	CMD.exe	94
PID 2160 wrote to memory of 5352	2160	obs.exe	95
PID 5352 wrote to memory of 5856	5352	CMD.exe	97
PID 2160 wrote to memory of 4216	2160	obs.exe	98
PID 4216 wrote to memory of 4984	4216	CMD.exe	100
PID 2160 wrote to memory of 1436	2160	obs.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe
"C:\Users\Admin\AppData\Local\Temp\18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:3396
- C:\Users\Admin\AppData\Local\Temp\18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe
  "C:\Users\Admin\AppData\Local\Temp\18c8206a81c2ad2d5e90c02b5bf14b843d19be35b7a90099b3baf01dd1d831ac.exe" d03728f89d47b29f55a54c01ba4b80ec2085f0e9601ada6c872dea7bf6e062f02c4af199ed5ff3a3d30ca24fc9b6a5b2ffa09879ff3a4ec84f75735481dbdc2d8297468e82bc902be399f677c02e341c6e47ff34df3ad4ee80909c2bedb73c8d858e4a7abf04bfe73f9ef998336f44c45eb8
  2⤵
  PID:5508

C:\Users\Admin\AppData\Local\LainStudio\obs.exe
C:\Users\Admin\AppData\Local\LainStudio\obs.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    PID:3872
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    PID:5856
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:4984
- C:\Users\Admin\AppData\Local\LainStudio\obs.exe
  "C:\Users\Admin\AppData\Local\LainStudio\obs.exe" 858d0f62c8e7393bb744df2c98d8904ad55dce6c706c8331b70bec3d6e53e23b97f1bf515f6dc7df70d10fe68d3aabec440d0bad82441396965a9777193e76cf251c2dab5adb6170766b8b5a5252f932d0bae9fab2a9940b9931542412aa464845c938bc9f52a8798907fa77d1cb4e91783b
  2⤵
  - Executes dropped EXE
  PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

obs.exe

Path C:\Users\Admin\AppData\Local\LainStudio\obs.exe
Size 6.3MB
SHA256 64402c23da64d779ce6b65d74a5a3675f35766c3f807917068bebaf0da6a8a8f
MD5 9026bb48c7dc23048eb3fd2e361e6c9a
SHA1 b7d6de97f8ede911ce602ce9f802977a3ba0b416
SHA512 ccae8a0223f366a321ef0bdd6ad1651760af2d2f4170a548e43647cf485d9466a628f06283437d350a92e8e46efcc02030ca21ae13cc2ec42796127228e57de3
SSDEEP 49152:Mcx3rMFn9+nnRF08JhnEoVg5iYK6tC8ggFiGITVN/jZOoj4n9f5KkqfKiK9Kv55c:MsckZVmKP8ggIGIDdgpFqb7Ep
TLSH
T121664B43ECA155E9C0BAD2318A639362BB717C485B3123D72B90F7282F76BD06E79750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3372-4-0x000001E35F6A0000-0x000001E35FE4E000-memory.dmp

Download