goproxy | 2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/03/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
Size 11.9MB
Sample260305-dacbesbs8x
SHA256 2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7
MD5 3816e4ea1d36a12a93dc383b4a9929af
SHA1 4147352d1b3841f30fece19b905537480e84071c
SHA512 1253dbbf398e8912b256cc1a9e09bb349e1d976abca306a29fdf21fd3d6606387bd615d97be5221c0a829ef2c0ae3002234419203db4d8a24c05ee8341201e12
SSDEEP 98304:yY3uYdjzt8pmt7wyfnnnbLmQzoyCPy/ep:yAfd3ipXyfnnnbLm4/ep
TLSH
T1B7C69CB2DC531664C67AA134000393A9F63E77D82367FAC71A8865654672BF43B3AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion goproxy persistence

Malware Config

Signatures

Detects GoProxy payload 17 IoCs

resource	yara_rule
behavioral1/memory/1676-0-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/1676-2-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/1676-4-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/1676-1-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/1676-3-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/3936-7-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/3936-8-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/3936-6-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/412-11-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/412-12-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/412-13-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/412-14-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/1920-16-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/1920-17-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/1920-19-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/1920-18-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral1/memory/1676-23-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy

GoProxy
GoProxy is a proxy malware written in Golang.
backdoor goproxy
Goproxy family
goproxy
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
defense_evasion

Software Discovery
T1518

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	wireshark.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe

Executes dropped EXE 2 IoCs

pid	Process
412	wireshark.exe
1920	wireshark.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	10	Go-http-client/1.1
HTTP User-Agent header	14	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1676	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
1676	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
412	wireshark.exe
412	wireshark.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2224	WMIC.exe
Token: SeSecurityPrivilege	2224	WMIC.exe
Token: SeTakeOwnershipPrivilege	2224	WMIC.exe
Token: SeLoadDriverPrivilege	2224	WMIC.exe
Token: SeSystemProfilePrivilege	2224	WMIC.exe
Token: SeSystemtimePrivilege	2224	WMIC.exe
Token: SeProfSingleProcessPrivilege	2224	WMIC.exe
Token: SeIncBasePriorityPrivilege	2224	WMIC.exe
Token: SeCreatePagefilePrivilege	2224	WMIC.exe
Token: SeBackupPrivilege	2224	WMIC.exe
Token: SeRestorePrivilege	2224	WMIC.exe
Token: SeShutdownPrivilege	2224	WMIC.exe
Token: SeDebugPrivilege	2224	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2224	WMIC.exe
Token: SeRemoteShutdownPrivilege	2224	WMIC.exe
Token: SeUndockPrivilege	2224	WMIC.exe
Token: SeManageVolumePrivilege	2224	WMIC.exe
Token: 33	2224	WMIC.exe
Token: 34	2224	WMIC.exe
Token: 35	2224	WMIC.exe
Token: 36	2224	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2224	WMIC.exe
Token: SeSecurityPrivilege	2224	WMIC.exe
Token: SeTakeOwnershipPrivilege	2224	WMIC.exe
Token: SeLoadDriverPrivilege	2224	WMIC.exe
Token: SeSystemProfilePrivilege	2224	WMIC.exe
Token: SeSystemtimePrivilege	2224	WMIC.exe
Token: SeProfSingleProcessPrivilege	2224	WMIC.exe
Token: SeIncBasePriorityPrivilege	2224	WMIC.exe
Token: SeCreatePagefilePrivilege	2224	WMIC.exe
Token: SeBackupPrivilege	2224	WMIC.exe
Token: SeRestorePrivilege	2224	WMIC.exe
Token: SeShutdownPrivilege	2224	WMIC.exe
Token: SeDebugPrivilege	2224	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2224	WMIC.exe
Token: SeRemoteShutdownPrivilege	2224	WMIC.exe
Token: SeUndockPrivilege	2224	WMIC.exe
Token: SeManageVolumePrivilege	2224	WMIC.exe
Token: 33	2224	WMIC.exe
Token: 34	2224	WMIC.exe
Token: 35	2224	WMIC.exe
Token: 36	2224	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3684	WMIC.exe
Token: SeSecurityPrivilege	3684	WMIC.exe
Token: SeTakeOwnershipPrivilege	3684	WMIC.exe
Token: SeLoadDriverPrivilege	3684	WMIC.exe
Token: SeSystemProfilePrivilege	3684	WMIC.exe
Token: SeSystemtimePrivilege	3684	WMIC.exe
Token: SeProfSingleProcessPrivilege	3684	WMIC.exe
Token: SeIncBasePriorityPrivilege	3684	WMIC.exe
Token: SeCreatePagefilePrivilege	3684	WMIC.exe
Token: SeBackupPrivilege	3684	WMIC.exe
Token: SeRestorePrivilege	3684	WMIC.exe
Token: SeShutdownPrivilege	3684	WMIC.exe
Token: SeDebugPrivilege	3684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3684	WMIC.exe
Token: SeRemoteShutdownPrivilege	3684	WMIC.exe
Token: SeUndockPrivilege	3684	WMIC.exe
Token: SeManageVolumePrivilege	3684	WMIC.exe
Token: 33	3684	WMIC.exe
Token: 34	3684	WMIC.exe
Token: 35	3684	WMIC.exe
Token: 36	3684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3684	WMIC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4556	1676	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe	86
PID 4556 wrote to memory of 2224	4556	CMD.exe	88
PID 1676 wrote to memory of 2128	1676	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe	90
PID 2128 wrote to memory of 3684	2128	CMD.exe	92
PID 1676 wrote to memory of 540	1676	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe	93
PID 540 wrote to memory of 4448	540	CMD.exe	96
PID 1676 wrote to memory of 3936	1676	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe	99
PID 412 wrote to memory of 724	412	wireshark.exe	104
PID 724 wrote to memory of 3344	724	CMD.exe	107
PID 412 wrote to memory of 1712	412	wireshark.exe	108
PID 1712 wrote to memory of 3996	1712	CMD.exe	110
PID 412 wrote to memory of 1916	412	wireshark.exe	111
PID 1916 wrote to memory of 3448	1916	CMD.exe	113
PID 412 wrote to memory of 1920	412	wireshark.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
"C:\Users\Admin\AppData\Local\Temp\2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:4448
- C:\Users\Admin\AppData\Local\Temp\2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
  "C:\Users\Admin\AppData\Local\Temp\2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe" 386ef2216281785d425ff5ba5d630411b829d45530f3afce418a4991733f452baf6cfecbc24a5d63cf30f74b4913352ce6f59ee1d5628b80774a6bde751b7ca44127d3986e06f55a808802ec841cf9681a5320bf8acae389dfcf8d5fd1ae6d791f10f0da1d22f7a10e00a34611f699ff3d7570
  2⤵
  PID:3936

C:\ProgramData\Wireshark\wireshark.exe
C:\ProgramData\Wireshark\wireshark.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    PID:3344
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    PID:3996
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:3448
- C:\ProgramData\Wireshark\wireshark.exe
  "C:\ProgramData\Wireshark\wireshark.exe" 3eb5c16313d17e46c27120faa5cc68e06c15fc0428f9073be0ee5cc2800e1e5fc39f2c9ce2f11851a1709616fda0271ea414152b17e7710f577f4719bb87ec102cbcae83911fb1e2e03d082a0a5fc68526711aece500a0e353c617ea5f8793238ebf3e2532af98f84271ac26f2811e2f42a37c
  2⤵
  - Executes dropped EXE
  PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wireshark.exe

Path C:\ProgramData\Wireshark\wireshark.exe
Size 11.9MB
SHA256 0a9a1ad6c474e31496f5643903f5bd4399f05c51f3092e2366f4b0cbf0e3a35c
MD5 6d37b3242533002b3e642c1d67658685
SHA1 faff94ea90e8797a427dd48e98bc750d3d2807f5
SHA512 37ca6b1c434f1cfd053ab0e6cea21ae6091111cad9dfccbbabf9f8d879afcdd3f630a774e62e310be56bbd4da970816ed1f125792156df83c8efa5a6ae5298a8
SSDEEP 98304:DY3uYdjzt8pmt7wyfnnnbLmQzoyCPy/ep:DAfd3ipXyfnnnbLm4/ep
TLSH
T1F8C69CB2DC531664C67AA134000393A9F63E77D82367FAC71A8865654672BF43B3AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-14-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/412-13-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/412-12-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/412-11-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/412-24-0x0000021A02FF0000-0x0000021A030BD000-memory.dmp

Download

memory/1676-1-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/1676-22-0x0000025D75A20000-0x0000025D75AED000-memory.dmp

Download

memory/1676-23-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/1676-3-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/1676-0-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/1676-4-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/1676-2-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/1920-19-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/1920-17-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/1920-16-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/1920-18-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/3936-6-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/3936-8-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/3936-7-0x0000000140000000-0x00000001407C3000-memory.dmp

Download