Hostile ^93% Download

633ad68daaf42d119ef95c7594d23773.exe

AV evasion, injection, keylogging

PoolParty thread-pool injection toolkitDebug-privilege injection into security processes

SHA-256d43c8476acb00d80f509248b65613957c2a4277c8cb443c4705e569f5753943b

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₉(Er₈I₂Co₃Pr₂AlAs₆CPXe)H₉(CrDb₅F₅Hf₅Mg₆Os₁₈Po₁₂TiU₅)Md₃(Bi₉PtSi₄)

Evidence

UTF-16 exe filename suffix token 0x160314–0x1603f4

0x1603146845ebff488d65205dc3489055534883hE..H.e ].H.USH.
0x160324ec28488bec4889d3488d4b38e86bfdea.(H..H..H.K8.k..
0x160334ff488d4b58488b156856eaffe83b45eb.H.KXH..hV...;E.
0x160344ff488d65285b5dc37600730073000000.H.e([].v.s.s...
0x16035462006400730065007200760069006300b.d.s.e.r.v.i.c.
0x160364650068006f00730074002e0065007800e.h.o.s.t...e.x.
0x16037465000000530063006800650064007500e...S.c.h.e.d.u.
0x1603846c0065000000cccccccccccc55534883l.e.........USH.
0x160394ec38488bec4889cb488b4b2033d2e899.8H..H..H.K 3...
0x1603a4eeffff480fb60089452c488b4b20488d...H....E,H.K H.
0x1603b4552c41b801000000e8efecffff488b4bU,A..........H.K
0x1603c4208b552ce863edffff488b4b20488d53 .U,.c...H.K H.S
0x1603d41841b804000000e8d0ecffff488d6538.A..........H.e8
0x1603e45b5dc3cccccccccccccccccc55565348[]..........UVSH
0x1603f483ec40488bec4889cb837b1800      [email protected]...{..   

References high-risk Windows token privilege 0x160d4c–0x160ecc

0x160d4caaeaffc7457070000000488d85e00000....Epp...H.....
0x160d5c0048898588000000c785a00000000000.H..............
0x160d6c0000c7457440000000488d4d70e812d3[email protected]...
0x160d7cffff85c0740733c9e8f705ecff8b854c....t.3........L
0x160d8c03000089454c90488d4d50ba02000000....EL.H.MP.....
0x160d9ce8dff3eaff8b454c488da5500300005b......ELH..P...[
0x160dac5e5dc390554883ec20488bec488d4a50^]..UH.. H..H.JP
0x160dbcba02000000e8baf3eaff488d65205dc3..........H.e ].
0x160dcc53006500440065006200750067005000S.e.D.e.b.u.g.P.
0x160ddc72006900760069006c00650067006500r.i.v.i.l.e.g.e.
0x160dec00000000b0040200ffffffff0c000000................
0x160dfc720075006e0064006c006c0033003200r.u.n.d.l.l.3.2.
0x160e0c2e006500780065000000cccccccccccc..e.x.e.........
0x160e1ccccccccc554881ec50060000488bec48....UH..P...H..H
0x160e2cc745280000000048c745200000000090.E(....H.E .....
0x160e3c33c9488d954804000041b804010000e83.H..H...A......
0x160e4c9006ecff488d4d20488d954804000041....H.M H..H...A
0x160e5cb804010000e8aa06ebff488d4d28488b..........H.M(H.
0x160e6c5520e82d4bedff488b4528488d0d2a01U .-K..H.E(H..*.
0x160e7c00004889c241b801000000e8840debff..H..A..........
0x160e8c85c07e0733c9e8e904ecffb904010000..~.3...........
0x160e9c488d9540020000e88807ecff85c0751b[email protected].
0x160eac488d8d4804000033d241b804000000e8H..H...3.A......
0x160ebc4009ecff33c9e8b904ecff488d8d4002@...3......H..@.
0x160ecc0000488d15ed0000004d33c04c8d4d38..H......M3.L.M8

PoolPartyBof injection module name 0x2ea7a4–0x2ea924

0x2ea7a42e576964655374725574696c730c5769.WideStrUtils.Wi
0x2ea7b46e6170692e4d734354461657696e6170napi.MsCTF.Winap
0x2ea7c4692e4d734354462e506b6748656c7065i.MsCTF.PkgHelpe
0x2ea7d4720f57696e6170692e52696368456469r.Winapi.RichEdi
0x2ea7e4740b56636c2e436f6d537472730d5663t.Vcl.ComStrs.Vc
0x2ea7f46c2e4c6973744163746e730b56636c2el.ListActns.Vcl.
0x2ea804546f6f6c57696e176672616d65776f72ToolWin.framewor
0x2ea8146b5f506f6f6c496e6a6563744c69620ck_PoolInjectLib.
0x2ea824506f6f6c5061727479426f6607584275PoolPartyBof.XBu
0x2ea834666665720b4d7954696d6572556e6974ffer.MyTimerUnit
0x2ea8440d57696e6170692e57696e5376630f57.Winapi.WinSvc.W
0x2ea854696e6170692e546c48656c703332ccccinapi.TlHelp32..
0x2ea86400000000000000000000000000000000................
0x2ea87400000000000000000000000000000000................
0x2ea88400000000000000000000000000000000................
0x2ea89400000000000000000000000000000000................
0x2ea8a400000000000000000000000000000000................
0x2ea8b400000000000000000000000000000000................
0x2ea8c400000000000000000000000000000000................
0x2ea8d400000000000000000000000000000000................
0x2ea8e400000000000000000000000000000000................
0x2ea8f400000000000000000000000000000000................
0x2ea90400000000000000000000000000000000................
0x2ea91400000000000000000000000000000000................
0x2ea924000000000000000000000000        ............    

Remote-process VirtualAllocEx allocation 0x33e170–0x33e460

⋯3 more rows
0x33e1a0bba9d1a9dda9efa902aa16aa2caa3eaa............,.>.
0x33e1b054aa60aa72aa85aa99aaafaac1aad7aaT.`.r...........
0x33e1c0e3aaf5aa08ab1eab30ab50ab62ab7eab........0.P.b.~.
0x33e1d09aaba6abb8abd4abfcab11ac32ac47ac............2.G.
0x33e1e05fac6bac7dac94acacacb8accaace0ac_.k.}...........
0x33e1f007ad19ad34ad61ad73ad8eadb2adc7ad....4.a.s.......
0x33e200dfadebad00ae1dae29ae3eae54ae60ae........).>.T.`.
0x33e21072ae84ae98aea4aeb9aedfaef1ae0cafr...............
0x33e22032af44af5faf85af97afb6afd2afdeaf2.D._...........
⋯9 more rows
0x33e2c040a548a550a558a560a568a570a578a5@.H.P.X.`.h.p.x.
0x33e2d080a595a5aea5c4a5cca5daa5e6a5f2a5................
0x33e2e0fea51fa63ca64ea666a684a699a6aba6....<.N.f.......
0x33e2f0b7a6c9a6e4a6f5a601a718a732a73aa7............2.:.
0x33e30058a763a771a7a2a7d8a717a81fa827a8X.c.q.........'.
0x33e3103da84fa868a8a0a8a8a8b0a8c6a8d9a8=.O.h...........
0x33e320f0a808a910a918a920a928a930a940a9........ .(.0.@.
0x33e33048a950a958a960a968a970a978a980a9H.P.X.`.h.p.x...
0x33e34088a990a998a9a0a9a8a9b0a9b8a9c0a9................
0x33e350c8a9d0a9d8a9e0a9e8a9f0a9f8a900aa................
0x33e36008aa10aa18aa20aa28aa30aa38aa40aa...... .(.0.8.@.
0x33e37048aa50aa58aa60aa68aa70aa82aaa0aaH.P.X.`.h.p.....
0x33e380b8aad7aadfaaeaaa03ab1dab36ab51ab............6.Q.
0x33e3905dab69ab75ab81ab8dab99aba5abb7ab].i.u...........
0x33e3a0ceabebabfdab14ac32ac47ac5bac67ac........2.G.[.g.
0x33e3b07cac94aca0acb2acc9acecacfeac15ad|...............
0x33e3c039ad4bad62ad74ad80ad95ada6adb2ad9.K.b.t.........
0x33e3d0c8addeade6ad04ae0fae1aae28ae38ae............(.8.
0x33e3e062ae96aed0aef0aef8ae00af08af10afb...............
0x33e3f020af28af30af38af40af48af50af58af .([email protected].
0x33e40060af68af70af78af80af88af90af98af`.h.p.x.........
0x33e410a0afa8afb0afb8afc0afc8afd0afd8af................
0x33e420e0afe8aff0aff8af00600e00c8010000.........`......
0x33e43000a008a010a018a020a028a030a045a0........ .(.0.E.
0x33e44063a07ea09ba0b4a0d1a0dda0e9a0f5a0c.~.............
0x33e45001a115a11da133a150a162a179a199a1......3.P.b.y...
0x33e460aba1bfa1d5a1f3a108a230a245a26da2..........0.E.m.

PoolInjectLib injection framework unit 0x38c9e4–0x38cb74

⋯7 more rows
0x38ca546974320000b06672616d65776f726b5fit2...framework_
0x38ca64506f6f6c496e6a6563744c696200006aPoolInjectLib..j
0x38ca74506f6f6c5061727479426f660000e758PoolPartyBof...X
0x38ca844275666665720000384d7954696d6572Buffer..8MyTimer
⋯15 more rows