Hostile ^93% Download

1beabccc2954aceebc2e51ad36b0f704add1b50081526717a3535115a7da980e.exe

Remote thread injection, anti-debug, C2

Unsigned native PE embeds CLR payload with anti-analysis loaderResource loader with registry and anti-debug

SHA-2561beabccc2954aceebc2e51ad36b0f704add1b50081526717a3535115a7da980e

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₈(As₁₀C₆Er₆Pr₂AlDyIXe)H₁₁(Po₁₉Cm₁₀Cr₂Db₇DsF₅Hf₅Mg₃Os₁₄TiU₄)Md₇(Bi₁₁HePaPt₂Si)

Evidence

VirtualAlloc commit RWX buffer 0x27a13–0x27ad3

0x27a1351048950048b49088948088343081068Q..P..I..H..C..h
0x27a23f0d8ffff8bc3e862baffff83c4048946.......b.......F
0x27a33088b531083ba1c010000000f85840000..S.............
0x27a43008d44244c50ff15f44049008b442450[email protected]$P
0x27a536a406800100000506a008bf8ff15dc40[email protected]......@
0x27a6349008b53108bc88b821801000085c075I..S...........u
0x27a7308898a18010000eb0e83380074078b00..........8.t...
0x27a8383380075f98908c701000000008b5310.8.u..........S.
0x27a9383c10483c7ee898a1c01000083ff0e76...............v
0x27aa31e83c7f1b825499224f7e72bfad1ef03.....%I.$..+....
0x27ab3fac1ef03474f8d410e89018bc875f6c7....GO.A.....u..
0x27ac30100000000837d08008b43108b881c01......}...C.....
0x27ad30000890e8b43108b901c0100008b    .....C........  

References the .NET mscoree loader name 0x92ccf–0x92f4f

⋯10 more rows
0x92d6f003d3b0000436f724578697450726f63.=;..CorExitProc
0x92d7f65737300006d00730063006f00720065ess..m.s.c.o.r.e
0x92d8f0065002e0064006c006c00000058934a.e...d.l.l...X.J
0x92d9f0013f24600a0934a005ff246005dd947...F...J._.F.].G
0x92daf0062616420616c6c6f636174696f6e00.bad allocation.
0x92dbf00636d642e657865002f630000434f4d.cmd.exe./c..COM
0x92dcf53504543000000000056697375616c20SPEC.....Visual 
⋯12 more rows
0x92e9f80000000000000000000000000000000................
0x92eaf0063006d0064002e0065007800650000.c.m.d...e.x.e..
0x92ebf002f0063000000000043004f004d0053./.c.....C.O.M.S
⋯9 more rows

Modify memory page protection 0x93fac–0x9429c

⋯4 more rows
0x93fec6573652d686f6e676b6f6e6700000000ese-hongkong....
0x93ffc6368696e657365006368690063686800chinese.chi.chh.
0x9400c63616e616469616e0000000062656c67canadian....belg
0x9401c69616e006175737472616c69616e0000ian.australian..
0x9402c616d65726963616e2d656e676c697368american-english
0x9403c00000000616d65726963616e20656e67....american eng
0x9404c6c69736800000000616d65726963616elish....american
0x9405c0000000054584900454e550040584900....TXI.ENU.@XI.
0x9406c454e55002c584900454e550020584900ENU.,XI.ENU. XI.
0x9407c454e4100185849004e4c42000c584900ENA..XI.NLB..XI.
0x9408c454e4300085849005a48480004584900ENC..XI.ZHH..XI.
0x9409c5a484900fc57490043485300e8574900ZHI..WI.CHS..WI.
0x940ac5a484800d457490043485300c0574900ZHH..WI.CHS..WI.
0x940bc5a484900ac574900434854009c574900ZHI..WI.CHT..WI.
0x940cc4e4c420088574900454e55007c574900NLB..WI.ENU.|WI.
0x940dc454e41006c574900454e4c0060574900ENA.lWI.ENL.`WI.
0x940ec454e43004c574900454e420040574900ENC.LWI.ENB.@WI.
0x940fc454e490030574900454e4a0024574900ENI.0WI.ENJ.$WI.
0x9410c454e5a000c574900454e5300f0564900ENZ..WI.ENS..VI.
0x9411c454e5400e4564900454e4700d8564900ENT..VI.ENG..VI.
0x9412c454e5500cc564900454e5500bc564900ENU..VI.ENU..VI.
0x9413c46524200ac5649004652430098564900FRB..VI.FRC..VI.
0x9414c46524c00885649004652530078564900FRL..VI.FRS.xVI.
0x9415c44454100645649004445430050564900DEA.dVI.DEC.PVI.
0x9416c44454c00405649004445530030564900[email protected].
0x9417c454e4900205649004954530014564900ENI. VI.ITS..VI.
0x9418c4e4f5200005649004e4f5200ec554900NOR..VI.NOR..UI.
0x9419c4e4f4e00d455490050544200c0554900NON..UI.PTB..UI.
0x941ac45535300b055490045534200a0554900ESS..UI.ESB..UI.
0x941bc45534c008c55490045534f0078554900ESL..UI.ESO.xUI.
0x941cc455343005c554900455344004c554900ESC.\UI.ESD.LUI.
0x941dc45534600385549004553450024554900ESF.8UI.ESE.$UI.
0x941ec45534700105549004553480000554900ESG..UI.ESH..UI.
0x941fc45534d00f054490045534e00dc544900ESM..TI.ESN..TI.
0x9420c45534900cc54490045534100b8544900ESI..TI.ESA..TI.
0x9421c45535a00a85449004553520094544900ESZ..TI.ESR..TI.
0x9422c45535500845449004553590070544900ESU..TI.ESY.pTI.
0x9423c45535600605449005356460058544900ESV.`TI.SVF.XTI.
0x9424c4445530054544900454e470050544900DES.TTI.ENG.PTI.
0x9425c454e55004c544900454e550044544900ENU.LTI.ENU.DTI.
0x9426c555341003c5449004742520034544900USA.<TI.GBR.4TI.
0x9427c43484e002c544900435a450024544900CHN.,TI.CZE.$TI.
0x9428c4742520014544900474252000c544900GBR..TI.GBR..TI.
0x9429c4e4c440000544900484b4700f4534900NLD..TI.HKG..SI.

CreateRemoteThread API string 0xac366–0xac626

⋯12 more rows
0xac426d101476574446c6c4469726563746f72..GetDllDirector
0xac43679570000a90043726561746552656d6fyW....CreateRemo
0xac44674655468726561640000e202496e6974teThread....Init
0xac45669616c697a65437269746963616c5365ializeCriticalSe
⋯6 more rows
0xac4c6450247657450726f6341646472657373E.GetProcAddress
0xac4d60000e9045669727475616c416c6c6f63....VirtualAlloc
0xac4e60000ee00456e74657243726974696361....EnterCritica
0xac4f66c53656374696f6e0000ea0456697274lSection....Virt
0xac50675616c416c6c6f634578000085034f70ualAllocEx....Op
0xac516656e54687265616400004c0247657450enThread..L.GetP
⋯6 more rows
0xac5867443757272656e7450726f6365737349tCurrentProcessI
0xac59664002e05577269746550726f63657373d...WriteProcess
0xac5a64d656d6f727900009302476574546963Memory....GetTic
0xac5b66b436f756e740000660453657446696ckCount..f.SetFil
⋯7 more rows

PE/MZ binary embedded in resource section 0xc6f9d–0xc713d

⋯7 more rows
0xc700d0000696e7465726f70000804027c0000..interop....|..
0xc701d4d5a90000300000004000000ffff0000MZ..............
0xc702db8000000000000004000000000000000........@.......
0xc703d00000000000000000000000000000000................
0xc704d00000000000000000000000080000000................
⋯15 more rows