Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM mitmproxy.exe
- '<SYSTEM32>\taskkill.exe' /F /IM cheatengine.exe
- '<SYSTEM32>\taskkill.exe' /F /IM procexp.exe
- '<SYSTEM32>\taskkill.exe' /F /IM extremeinjector.exe
- '<SYSTEM32>\taskkill.exe' /F /IM charles.exe
- '<SYSTEM32>\taskkill.exe' /F /IM cheatengine-x86_64.exe
- '<SYSTEM32>\taskkill.exe' /F /IM objection.exe
- '<SYSTEM32>\taskkill.exe' /F /IM die.exe
- '<SYSTEM32>\taskkill.exe' /F /IM idaq64.exe
- '<SYSTEM32>\taskkill.exe' /F /IM httpdebuggerui.exe
- '<SYSTEM32>\taskkill.exe' /F /IM burpsuite.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ollydbg.exe
- '<SYSTEM32>\taskkill.exe' /F /IM wireshark.exe
- '<SYSTEM32>\taskkill.exe' /F /IM dotpeek.exe
- '<SYSTEM32>\taskkill.exe' /F /IM fiddler.exe
- '<SYSTEM32>\taskkill.exe' /F /IM procmon.exe
- '<SYSTEM32>\taskkill.exe' /F /IM x64dbg.exe
- '<SYSTEM32>\taskkill.exe' /F /IM frida-server.exe
- '<SYSTEM32>\taskkill.exe' /F /IM x32dbg.exe
- '<SYSTEM32>\taskkill.exe' /F /IM dnspy.exe
- '<SYSTEM32>\taskkill.exe' /F /IM dumpcap.exe
- '<SYSTEM32>\taskkill.exe' /F /IM processhacker.exe
- '<SYSTEM32>\taskkill.exe' /F /IM pestudio.exe
- '<SYSTEM32>\taskkill.exe' /F /IM dllinjector.exe
- '<SYSTEM32>\taskkill.exe' /F /IM procexp64.exe
- '<SYSTEM32>\taskkill.exe' /F /IM tshark.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ida64.exe
- '<SYSTEM32>\taskkill.exe' /F /IM windbg.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ida.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ilspy.exe
- '<SYSTEM32>\taskkill.exe' /F /IM frida.exe
- '<SYSTEM32>\taskkill.exe' /F /IM cheatengine-i386.exe
- '<SYSTEM32>\taskkill.exe' /F /IM idaq.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ghidra.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ghidrarun.exe
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\tasklist.exe
Modifies file system
Creates the following files
- %TEMP%\onefile_4492_134168942859323155\launcher.dll
- %TEMP%\onefile_4492_134168942859323155\_bz2.pyd
- %TEMP%\onefile_4492_134168942859323155\_ctypes.pyd
- %TEMP%\onefile_4492_134168942859323155\_decimal.pyd
- %TEMP%\onefile_4492_134168942859323155\_hashlib.pyd
- %TEMP%\onefile_4492_134168942859323155\_lzma.pyd
- %TEMP%\onefile_4492_134168942859323155\_socket.pyd
- %TEMP%\onefile_4492_134168942859323155\_ssl.pyd
- %TEMP%\onefile_4492_134168942859323155\libcrypto-3.dll
- %TEMP%\onefile_4492_134168942859323155\libffi-8.dll
- %TEMP%\onefile_4492_134168942859323155\libssl-3.dll
- %TEMP%\onefile_4492_134168942859323155\python311.dll
- %TEMP%\onefile_4492_134168942859323155\select.pyd
- %TEMP%\onefile_4492_134168942859323155\unicodedata.pyd
- %TEMP%\onefile_4492_134168942859323155\vcruntime140.dll
Network activity
Connects to
- '1.#.1.1':443
- '10#.#1.22.246':443
TCP
Other
- '1.#.1.1':443
- '10#.#1.22.246':443
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c
- '<SYSTEM32>\tasklist.exe' /FO CSV /NH
- '<SYSTEM32>\tasklist.exe' /FO CSV /NH' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM mitmproxy.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM cheatengine.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM procexp.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM extremeinjector.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM charles.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM cheatengine-x86_64.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM objection.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM die.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM idaq64.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM httpdebuggerui.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM burpsuite.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ollydbg.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM wireshark.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM dotpeek.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM fiddler.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM procmon.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM x64dbg.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM frida-server.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM x32dbg.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM dnspy.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM dumpcap.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM processhacker.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM pestudio.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM dllinjector.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM procexp64.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM tshark.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ida64.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM windbg.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ida.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ilspy.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM frida.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM cheatengine-i386.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM idaq.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ghidra.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ghidrarun.exe' (with hidden window)
