goproxy | 8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216

Analysis

max time kernel
148s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/03/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe
Size 6.2MB
Sample260305-d2vbbacx7t
SHA256 8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216
MD5 1316a271dcd4dd1146ac0ea5c9b14618
SHA1 1bbc54a5e980640f6b8e0ae88a48ea721f438b69
SHA512 f50440b5ff50a067116bb95643aa2c6e444a0f7c3e51a72230584a55bc2a824ed4498ce67ce925df53b539dd75ea9013a88689c8a8126b79e198e46aa0fc6900
SSDEEP 49152:2baYBTUGMi4Pdjpt6/9AqCnxjXksNCupVwk7vCS1SqAj2afaMwKeK9KptH5Ezi:2bBkOYntXqupCkOw++HEzi
TLSH
T1F8664A43EC9515E9C1EEE2358A629253BA717C486B3123D73F90F7282F72BD06AB4714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor goproxy persistence

Malware Config

Signatures

Detects GoProxy payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b4a5-1.dat	family_goproxy

GoProxy
GoProxy is a proxy malware written in Golang.
backdoor goproxy
Goproxy family
goproxy

Executes dropped EXE 2 IoCs

pid	Process
5988	thunderbird.exe
6140	thunderbird.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

GoLang User-Agent 4 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	6	Go-http-client/1.1
HTTP User-Agent header	7	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3288	8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe
3288	8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe
5988	thunderbird.exe
5988	thunderbird.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5216	WMIC.exe
Token: SeSecurityPrivilege	5216	WMIC.exe
Token: SeTakeOwnershipPrivilege	5216	WMIC.exe
Token: SeLoadDriverPrivilege	5216	WMIC.exe
Token: SeSystemProfilePrivilege	5216	WMIC.exe
Token: SeSystemtimePrivilege	5216	WMIC.exe
Token: SeProfSingleProcessPrivilege	5216	WMIC.exe
Token: SeIncBasePriorityPrivilege	5216	WMIC.exe
Token: SeCreatePagefilePrivilege	5216	WMIC.exe
Token: SeBackupPrivilege	5216	WMIC.exe
Token: SeRestorePrivilege	5216	WMIC.exe
Token: SeShutdownPrivilege	5216	WMIC.exe
Token: SeDebugPrivilege	5216	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5216	WMIC.exe
Token: SeRemoteShutdownPrivilege	5216	WMIC.exe
Token: SeUndockPrivilege	5216	WMIC.exe
Token: SeManageVolumePrivilege	5216	WMIC.exe
Token: 33	5216	WMIC.exe
Token: 34	5216	WMIC.exe
Token: 35	5216	WMIC.exe
Token: 36	5216	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5216	WMIC.exe
Token: SeSecurityPrivilege	5216	WMIC.exe
Token: SeTakeOwnershipPrivilege	5216	WMIC.exe
Token: SeLoadDriverPrivilege	5216	WMIC.exe
Token: SeSystemProfilePrivilege	5216	WMIC.exe
Token: SeSystemtimePrivilege	5216	WMIC.exe
Token: SeProfSingleProcessPrivilege	5216	WMIC.exe
Token: SeIncBasePriorityPrivilege	5216	WMIC.exe
Token: SeCreatePagefilePrivilege	5216	WMIC.exe
Token: SeBackupPrivilege	5216	WMIC.exe
Token: SeRestorePrivilege	5216	WMIC.exe
Token: SeShutdownPrivilege	5216	WMIC.exe
Token: SeDebugPrivilege	5216	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5216	WMIC.exe
Token: SeRemoteShutdownPrivilege	5216	WMIC.exe
Token: SeUndockPrivilege	5216	WMIC.exe
Token: SeManageVolumePrivilege	5216	WMIC.exe
Token: 33	5216	WMIC.exe
Token: 34	5216	WMIC.exe
Token: 35	5216	WMIC.exe
Token: 36	5216	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5360	WMIC.exe
Token: SeSecurityPrivilege	5360	WMIC.exe
Token: SeTakeOwnershipPrivilege	5360	WMIC.exe
Token: SeLoadDriverPrivilege	5360	WMIC.exe
Token: SeSystemProfilePrivilege	5360	WMIC.exe
Token: SeSystemtimePrivilege	5360	WMIC.exe
Token: SeProfSingleProcessPrivilege	5360	WMIC.exe
Token: SeIncBasePriorityPrivilege	5360	WMIC.exe
Token: SeCreatePagefilePrivilege	5360	WMIC.exe
Token: SeBackupPrivilege	5360	WMIC.exe
Token: SeRestorePrivilege	5360	WMIC.exe
Token: SeShutdownPrivilege	5360	WMIC.exe
Token: SeDebugPrivilege	5360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5360	WMIC.exe
Token: SeRemoteShutdownPrivilege	5360	WMIC.exe
Token: SeUndockPrivilege	5360	WMIC.exe
Token: SeManageVolumePrivilege	5360	WMIC.exe
Token: 33	5360	WMIC.exe
Token: 34	5360	WMIC.exe
Token: 35	5360	WMIC.exe
Token: 36	5360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5360	WMIC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4600	3288	8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe	81
PID 4600 wrote to memory of 5216	4600	CMD.exe	83
PID 3288 wrote to memory of 5336	3288	8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe	85
PID 5336 wrote to memory of 5360	5336	CMD.exe	87
PID 3288 wrote to memory of 5448	3288	8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe	88
PID 5448 wrote to memory of 5284	5448	CMD.exe	90
PID 3288 wrote to memory of 5656	3288	8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe	91
PID 5988 wrote to memory of 5788	5988	thunderbird.exe	94
PID 5788 wrote to memory of 5856	5788	CMD.exe	96
PID 5988 wrote to memory of 5404	5988	thunderbird.exe	97
PID 5404 wrote to memory of 5804	5404	CMD.exe	99
PID 5988 wrote to memory of 1928	5988	thunderbird.exe	100
PID 1928 wrote to memory of 5596	1928	CMD.exe	102
PID 5988 wrote to memory of 6140	5988	thunderbird.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe
"C:\Users\Admin\AppData\Local\Temp\8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5216
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:5284
- C:\Users\Admin\AppData\Local\Temp\8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe
  "C:\Users\Admin\AppData\Local\Temp\8c13e32e0e1201ceec5e3a88c396f31d5cf9f79da86d7f95f72df47bf9f64216.exe" d6ad4a8cb36b6a6c9f878566f38dc496dc7dd3ae33122deef221755ad54ddf37b2a8447f01c0f5805f7c46cea06723e673a90eb0bf939eed16e87f2f986609ee1bf170ec64dfae533ee95b021241d656d8a4534ee3efe764a60415632150432d0ea72f3bf134590cd48b0a5ad9bbfbb3e28c36
  2⤵
  PID:5656

C:\ProgramData\Mozilla\thunderbird.exe
C:\ProgramData\Mozilla\thunderbird.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    PID:5856
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    PID:5804
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:5596
- C:\ProgramData\Mozilla\thunderbird.exe
  "C:\ProgramData\Mozilla\thunderbird.exe" 72ea4d5c2e24c68e656121fc72aaf1734f8c7c22e892ccb4c93443c014ccde57c81a1a98eea11fad265e3b011fc7583a6c6a490170907028cb3e6f459551088b4618eb6dcfeb7e89ee272d5bfb46785d795b98d365d982dd9769031f320a2bf5f2302e5021f9516bae01ce096d29d35b3b4c91
  2⤵
  - Executes dropped EXE
  PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

thunderbird.exe

Path C:\ProgramData\Mozilla\thunderbird.exe
Size 6.2MB
SHA256 f2b2f1776d910f1c83bd649fe5046ab83f4c2ef27971d6200e5418e23e2228cd
MD5 7d9658afe2b6fd592578b2379efc9bf4
SHA1 33ac8d05a7ba8a96990c19ccd1e0734985dd4c3d
SHA512 ad563e088ed9ee2a996a3b37433fbb2cfe886fed1a13d6c4f680c9404980e9222261b1d5f23cdc8bde9017053cc5f711a695c7950b1cfb80353faf3542cb235e
SSDEEP 49152:dbaYBTUGMi4Pdjpt6/9AqCnxjXksNCupVwk7vCS1SqAj2afaMwKeK9KptH5Ezi:dbBkOYntXqupCkOw++HEzi
TLSH
T188664A43EC9515E9C1EEE2358A629253BA717C486B3123D73F90F7282F72BD06AB4714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download