goproxy | 42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/03/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe
Size 6.3MB
Sample260305-dfenqsh17j
SHA256 42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656
MD5 180faa9a2e010800b9dd1ec52775ad2c
SHA1 6b9503a673b34937cb255fe106f21657ff104d14
SHA512 d450acb71f10cadf415f240e328a97e30dc729b074343d793b38ae3dacf68cf73860d221d9f3b046211260058b1ed8990eeb89aaac5bab4d0441fae6c1cbdb18
SSDEEP 49152:uByjC8U6VwSRMkf0+PKK6M/vxNeuWbZP5vccmafU7GP6Hj6w9v5ecfKiK9KvWK3E:uU/MS7RWd5vNmA4tbbWIxE7
TLSH
T1EE664B03ECA555E9C0E9E2318A679252BB717C885B3123D32F90F7282F76BD06E79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor goproxy persistence

Malware Config

Signatures

Detects GoProxy payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b4c8-1.dat	family_goproxy

GoProxy
GoProxy is a proxy malware written in Golang.
backdoor goproxy
Goproxy family
goproxy

Executes dropped EXE 2 IoCs

pid	Process
5852	hxd.exe
2804	hxd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	5	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4660	42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe
4660	42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe
5852	hxd.exe
5852	hxd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5124	WMIC.exe
Token: SeSecurityPrivilege	5124	WMIC.exe
Token: SeTakeOwnershipPrivilege	5124	WMIC.exe
Token: SeLoadDriverPrivilege	5124	WMIC.exe
Token: SeSystemProfilePrivilege	5124	WMIC.exe
Token: SeSystemtimePrivilege	5124	WMIC.exe
Token: SeProfSingleProcessPrivilege	5124	WMIC.exe
Token: SeIncBasePriorityPrivilege	5124	WMIC.exe
Token: SeCreatePagefilePrivilege	5124	WMIC.exe
Token: SeBackupPrivilege	5124	WMIC.exe
Token: SeRestorePrivilege	5124	WMIC.exe
Token: SeShutdownPrivilege	5124	WMIC.exe
Token: SeDebugPrivilege	5124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5124	WMIC.exe
Token: SeRemoteShutdownPrivilege	5124	WMIC.exe
Token: SeUndockPrivilege	5124	WMIC.exe
Token: SeManageVolumePrivilege	5124	WMIC.exe
Token: 33	5124	WMIC.exe
Token: 34	5124	WMIC.exe
Token: 35	5124	WMIC.exe
Token: 36	5124	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5124	WMIC.exe
Token: SeSecurityPrivilege	5124	WMIC.exe
Token: SeTakeOwnershipPrivilege	5124	WMIC.exe
Token: SeLoadDriverPrivilege	5124	WMIC.exe
Token: SeSystemProfilePrivilege	5124	WMIC.exe
Token: SeSystemtimePrivilege	5124	WMIC.exe
Token: SeProfSingleProcessPrivilege	5124	WMIC.exe
Token: SeIncBasePriorityPrivilege	5124	WMIC.exe
Token: SeCreatePagefilePrivilege	5124	WMIC.exe
Token: SeBackupPrivilege	5124	WMIC.exe
Token: SeRestorePrivilege	5124	WMIC.exe
Token: SeShutdownPrivilege	5124	WMIC.exe
Token: SeDebugPrivilege	5124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5124	WMIC.exe
Token: SeRemoteShutdownPrivilege	5124	WMIC.exe
Token: SeUndockPrivilege	5124	WMIC.exe
Token: SeManageVolumePrivilege	5124	WMIC.exe
Token: 33	5124	WMIC.exe
Token: 34	5124	WMIC.exe
Token: 35	5124	WMIC.exe
Token: 36	5124	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5360	WMIC.exe
Token: SeSecurityPrivilege	5360	WMIC.exe
Token: SeTakeOwnershipPrivilege	5360	WMIC.exe
Token: SeLoadDriverPrivilege	5360	WMIC.exe
Token: SeSystemProfilePrivilege	5360	WMIC.exe
Token: SeSystemtimePrivilege	5360	WMIC.exe
Token: SeProfSingleProcessPrivilege	5360	WMIC.exe
Token: SeIncBasePriorityPrivilege	5360	WMIC.exe
Token: SeCreatePagefilePrivilege	5360	WMIC.exe
Token: SeBackupPrivilege	5360	WMIC.exe
Token: SeRestorePrivilege	5360	WMIC.exe
Token: SeShutdownPrivilege	5360	WMIC.exe
Token: SeDebugPrivilege	5360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5360	WMIC.exe
Token: SeRemoteShutdownPrivilege	5360	WMIC.exe
Token: SeUndockPrivilege	5360	WMIC.exe
Token: SeManageVolumePrivilege	5360	WMIC.exe
Token: 33	5360	WMIC.exe
Token: 34	5360	WMIC.exe
Token: 35	5360	WMIC.exe
Token: 36	5360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5360	WMIC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1412	4660	42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe	80
PID 1412 wrote to memory of 5124	1412	CMD.exe	82
PID 4660 wrote to memory of 5280	4660	42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe	84
PID 5280 wrote to memory of 5360	5280	CMD.exe	86
PID 4660 wrote to memory of 5444	4660	42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe	87
PID 5444 wrote to memory of 5304	5444	CMD.exe	89
PID 4660 wrote to memory of 1168	4660	42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe	90
PID 5852 wrote to memory of 5548	5852	hxd.exe	93
PID 5548 wrote to memory of 5708	5548	CMD.exe	95
PID 5852 wrote to memory of 5592	5852	hxd.exe	96
PID 5592 wrote to memory of 5712	5592	CMD.exe	98
PID 5852 wrote to memory of 5768	5852	hxd.exe	99
PID 5768 wrote to memory of 5784	5768	CMD.exe	101
PID 5852 wrote to memory of 2804	5852	hxd.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe
"C:\Users\Admin\AppData\Local\Temp\42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5280
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:5304
- C:\Users\Admin\AppData\Local\Temp\42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe
  "C:\Users\Admin\AppData\Local\Temp\42ba972b74d4b798fb8b38110d38d01a3ad424fa6077ba4da5a0a2b531064656.exe" 1feec311a1c3f1084a71520e70e3a34be51bb0a0fa03c486b9458909f3b9310235754ec5213f9fba3e2ca29f302a2ab1c666ef49770e0c06bc66e32841ba6f0ddd3f22a86163743c6cb0d6b7bd8d8198a55158872e8ccc48bfe9543fedabe0a9e9d625dc1b3c7a31e596e8b5e59a1682e846
  2⤵
  PID:1168

C:\Users\Admin\AppData\Local\HXD\hxd.exe
C:\Users\Admin\AppData\Local\HXD\hxd.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    PID:5708
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    PID:5712
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:5784
- C:\Users\Admin\AppData\Local\HXD\hxd.exe
  "C:\Users\Admin\AppData\Local\HXD\hxd.exe" bf90935c25d86e8cba56a1c1460be4de6189ed75e199d938724e0b4264eabaf5a1aac9e52de9b66658da6900eb02d2eaca0090ca02aab32f696396df54a742107783b3f806600bdfb8d65b8d767cfa95377ef45ed03ad9c3537443d97d2b9524666be7c1d3219a56fe2b23161e30de722d7d
  2⤵
  - Executes dropped EXE
  PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hxd.exe

Path C:\Users\Admin\AppData\Local\HXD\hxd.exe
Size 6.3MB
SHA256 8da99f91d32e0b9f6c1abe7a29c396d2cc247b889e73e73cc940920c1cf8aad2
MD5 fcd692c0e0f0ce4f56a06999cec99542
SHA1 323c6c17aca680eff5d85e0b81f5bf5a785c5a7f
SHA512 0420ebe9b7f379396b3d58e356bd53cab4e4905732d61ee739db0a7799b023fd3ad66b03d5e2ab2787cb07786a40bc7673ec33fc4cd537e99f4facc4484a2ebf
SSDEEP 49152:5ByjC8U6VwSRMkf0+PKK6M/vxNeuWbZP5vccmafU7GP6Hj6w9v5ecfKiK9KvWK3E:5U/MS7RWd5vNmA4tbbWIxE7
TLSH
T1FF664B03ECA555E9C0E9E2318A679252BB717C885B3123D32F90F7282F76BD06E79750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download