goproxy | 2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/03/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
Size 11.9MB
Sample260305-dacbesbs8x
SHA256 2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7
MD5 3816e4ea1d36a12a93dc383b4a9929af
SHA1 4147352d1b3841f30fece19b905537480e84071c
SHA512 1253dbbf398e8912b256cc1a9e09bb349e1d976abca306a29fdf21fd3d6606387bd615d97be5221c0a829ef2c0ae3002234419203db4d8a24c05ee8341201e12
SSDEEP 98304:yY3uYdjzt8pmt7wyfnnnbLmQzoyCPy/ep:yAfd3ipXyfnnnbLm4/ep
TLSH
T1B7C69CB2DC531664C67AA134000393A9F63E77D82367FAC71A8865654672BF43B3AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion goproxy persistence

Malware Config

Signatures

Detects GoProxy payload 16 IoCs

resource	yara_rule
behavioral2/memory/2188-0-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/2188-3-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/2188-2-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/2188-4-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/3380-6-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/3380-7-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/3380-8-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/5548-11-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/5548-12-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/5548-13-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/5548-14-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/5932-16-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/5932-17-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/5932-18-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/5932-19-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/2188-22-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy

GoProxy
GoProxy is a proxy malware written in Golang.
backdoor goproxy
Goproxy family
goproxy
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
defense_evasion

Software Discovery
T1518

Executes dropped EXE 2 IoCs

pid	Process
5548	wireshark.exe
5932	wireshark.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	5	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2188	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
2188	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
5548	wireshark.exe
5548	wireshark.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5916	WMIC.exe
Token: SeSecurityPrivilege	5916	WMIC.exe
Token: SeTakeOwnershipPrivilege	5916	WMIC.exe
Token: SeLoadDriverPrivilege	5916	WMIC.exe
Token: SeSystemProfilePrivilege	5916	WMIC.exe
Token: SeSystemtimePrivilege	5916	WMIC.exe
Token: SeProfSingleProcessPrivilege	5916	WMIC.exe
Token: SeIncBasePriorityPrivilege	5916	WMIC.exe
Token: SeCreatePagefilePrivilege	5916	WMIC.exe
Token: SeBackupPrivilege	5916	WMIC.exe
Token: SeRestorePrivilege	5916	WMIC.exe
Token: SeShutdownPrivilege	5916	WMIC.exe
Token: SeDebugPrivilege	5916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5916	WMIC.exe
Token: SeRemoteShutdownPrivilege	5916	WMIC.exe
Token: SeUndockPrivilege	5916	WMIC.exe
Token: SeManageVolumePrivilege	5916	WMIC.exe
Token: 33	5916	WMIC.exe
Token: 34	5916	WMIC.exe
Token: 35	5916	WMIC.exe
Token: 36	5916	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5916	WMIC.exe
Token: SeSecurityPrivilege	5916	WMIC.exe
Token: SeTakeOwnershipPrivilege	5916	WMIC.exe
Token: SeLoadDriverPrivilege	5916	WMIC.exe
Token: SeSystemProfilePrivilege	5916	WMIC.exe
Token: SeSystemtimePrivilege	5916	WMIC.exe
Token: SeProfSingleProcessPrivilege	5916	WMIC.exe
Token: SeIncBasePriorityPrivilege	5916	WMIC.exe
Token: SeCreatePagefilePrivilege	5916	WMIC.exe
Token: SeBackupPrivilege	5916	WMIC.exe
Token: SeRestorePrivilege	5916	WMIC.exe
Token: SeShutdownPrivilege	5916	WMIC.exe
Token: SeDebugPrivilege	5916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5916	WMIC.exe
Token: SeRemoteShutdownPrivilege	5916	WMIC.exe
Token: SeUndockPrivilege	5916	WMIC.exe
Token: SeManageVolumePrivilege	5916	WMIC.exe
Token: 33	5916	WMIC.exe
Token: 34	5916	WMIC.exe
Token: 35	5916	WMIC.exe
Token: 36	5916	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5344	WMIC.exe
Token: SeSecurityPrivilege	5344	WMIC.exe
Token: SeTakeOwnershipPrivilege	5344	WMIC.exe
Token: SeLoadDriverPrivilege	5344	WMIC.exe
Token: SeSystemProfilePrivilege	5344	WMIC.exe
Token: SeSystemtimePrivilege	5344	WMIC.exe
Token: SeProfSingleProcessPrivilege	5344	WMIC.exe
Token: SeIncBasePriorityPrivilege	5344	WMIC.exe
Token: SeCreatePagefilePrivilege	5344	WMIC.exe
Token: SeBackupPrivilege	5344	WMIC.exe
Token: SeRestorePrivilege	5344	WMIC.exe
Token: SeShutdownPrivilege	5344	WMIC.exe
Token: SeDebugPrivilege	5344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5344	WMIC.exe
Token: SeRemoteShutdownPrivilege	5344	WMIC.exe
Token: SeUndockPrivilege	5344	WMIC.exe
Token: SeManageVolumePrivilege	5344	WMIC.exe
Token: 33	5344	WMIC.exe
Token: 34	5344	WMIC.exe
Token: 35	5344	WMIC.exe
Token: 36	5344	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5344	WMIC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3388	2188	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe	80
PID 3388 wrote to memory of 5916	3388	CMD.exe	82
PID 2188 wrote to memory of 5404	2188	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe	84
PID 5404 wrote to memory of 5344	5404	CMD.exe	86
PID 2188 wrote to memory of 2256	2188	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe	87
PID 2256 wrote to memory of 3960	2256	CMD.exe	89
PID 2188 wrote to memory of 3380	2188	2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe	90
PID 5548 wrote to memory of 6028	5548	wireshark.exe	93
PID 6028 wrote to memory of 5920	6028	CMD.exe	95
PID 5548 wrote to memory of 5740	5548	wireshark.exe	96
PID 5740 wrote to memory of 5816	5740	CMD.exe	98
PID 5548 wrote to memory of 5788	5548	wireshark.exe	99
PID 5788 wrote to memory of 4888	5788	CMD.exe	101
PID 5548 wrote to memory of 5932	5548	wireshark.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
"C:\Users\Admin\AppData\Local\Temp\2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:3960
- C:\Users\Admin\AppData\Local\Temp\2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe
  "C:\Users\Admin\AppData\Local\Temp\2394203dbadfdbf0016e49604c0fe7295f2d355c5a2d301836f50a0c222ea2e7.exe" cd4e623b4dade8c440bef090ceeb2ee8310d60add6482051a5f03401af12bd1ea579dc3133644f9c0f2cda1ead8d0ec4157b18664be79b3062ae10cda9a940bff69f8b0e0c64ccc681d4721819f29fd3cfb7f8a9f2ecb3cbd4e43d335a0b299615cdff026e73f5b6421683c5c3aac03e75b850
  2⤵
  PID:3380

C:\ProgramData\Wireshark\wireshark.exe
C:\ProgramData\Wireshark\wireshark.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    PID:5920
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    PID:5816
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:4888
- C:\ProgramData\Wireshark\wireshark.exe
  "C:\ProgramData\Wireshark\wireshark.exe" 34d1ae7fb13cb4daa7f6aa071e78a2ea19207400a1fd4e2829e78fca41473b75075d22031450f9ace8ae6937c052948be9917c0542294c48a27c1b02b16c7f07512026ffd4f327e05006bba7208bb8a3682744738ada0d2fa2fe9818041d7b0dba7081a15bf29a23619a6e807c1759950df8bf
  2⤵
  - Executes dropped EXE
  PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wireshark.exe

Path C:\ProgramData\Wireshark\wireshark.exe
Size 11.9MB
SHA256 0a9a1ad6c474e31496f5643903f5bd4399f05c51f3092e2366f4b0cbf0e3a35c
MD5 6d37b3242533002b3e642c1d67658685
SHA1 faff94ea90e8797a427dd48e98bc750d3d2807f5
SHA512 37ca6b1c434f1cfd053ab0e6cea21ae6091111cad9dfccbbabf9f8d879afcdd3f630a774e62e310be56bbd4da970816ed1f125792156df83c8efa5a6ae5298a8
SSDEEP 98304:DY3uYdjzt8pmt7wyfnnnbLmQzoyCPy/ep:DAfd3ipXyfnnnbLm4/ep
TLSH
T1F8C69CB2DC531664C67AA134000393A9F63E77D82367FAC71A8865654672BF43B3AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2188-22-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/2188-3-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/2188-2-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/2188-4-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/2188-0-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/3380-6-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/3380-7-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/3380-8-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/5548-11-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/5548-13-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/5548-14-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/5548-12-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/5932-16-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/5932-17-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/5932-18-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/5932-19-0x0000000140000000-0x00000001407C3000-memory.dmp

Download