Overview
overview
10Static
static
803ff897da4...b3.exe
windows7_x64
703ff897da4...b3.exe
windows10_x64
710493d98a6...41.exe
windows7_x64
710493d98a6...41.exe
windows10_x64
711747d3247...67.exe
windows7_x64
711747d3247...67.exe
windows10_x64
San11 Tc/D...eg.htm
windows7_x64
1San11 Tc/D...eg.htm
windows10_x64
1San11 Tc/DrvMgt.dll
windows7_x64
1San11 Tc/DrvMgt.dll
windows10_x64
1San11 Tc/L...es.exe
windows7_x64
1San11 Tc/L...es.exe
windows10_x64
1San11 Tc/S...er.exe
windows7_x64
1San11 Tc/S...er.exe
windows10_x64
1San11 Tc/S...er.exe
windows7_x64
1San11 Tc/S...er.exe
windows10_x64
1San11 Tc/S...YS.exe
windows7_x64
San11 Tc/S...YS.exe
windows10_x64
San11 Tc/San11.exe
windows7_x64
8San11 Tc/San11.exe
windows10_x64
8San11 Tc/san11pk.exe
windows7_x64
3San11 Tc/san11pk.exe
windows10_x64
1San11 Tc/�...��.exe
windows7_x64
3San11 Tc/�...��.exe
windows10_x64
1023c9e16cc6...7b.exe
windows7_x64
523c9e16cc6...7b.exe
windows10_x64
536a18ae31f...d0.exe
windows7_x64
736a18ae31f...d0.exe
windows10_x64
74109a062b3...d4.exe
windows7_x64
84109a062b3...d4.exe
windows10_x64
8CW3.exe
windows7_x64
1CW3.exe
windows10_x64
1Analysis
-
max time kernel
88s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 15:32
Static task
static1
Behavioral task
behavioral1
Sample
03ff897da4bfb8bc549fdb1ebf7ee940bcb9b57fed7d26d83c45d1e9ec1f40b3.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
03ff897da4bfb8bc549fdb1ebf7ee940bcb9b57fed7d26d83c45d1e9ec1f40b3.exe
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
10493d98a6e78b7bbc60a9aae5ce5fa1a67cdace2a6be41740c92e21dcdb5f41.exe
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
10493d98a6e78b7bbc60a9aae5ce5fa1a67cdace2a6be41740c92e21dcdb5f41.exe
Resource
win10-en-20210920
Behavioral task
behavioral5
Sample
11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Resource
win7-en-20211014
Behavioral task
behavioral6
Sample
11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Resource
win10-en-20210920
Behavioral task
behavioral7
Sample
San11 Tc/Doc/Reg/san11_reg.htm
Resource
win7-en-20210920
Behavioral task
behavioral8
Sample
San11 Tc/Doc/Reg/san11_reg.htm
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
San11 Tc/DrvMgt.dll
Resource
win7-en-20210920
Behavioral task
behavioral10
Sample
San11 Tc/DrvMgt.dll
Resource
win10-en-20211014
Behavioral task
behavioral11
Sample
San11 Tc/LinkSan11Res.exe
Resource
win7-en-20210920
Behavioral task
behavioral12
Sample
San11 Tc/LinkSan11Res.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
San11 Tc/S11Launcher.exe
Resource
win7-en-20210920
Behavioral task
behavioral14
Sample
San11 Tc/S11Launcher.exe
Resource
win10-en-20210920
Behavioral task
behavioral15
Sample
San11 Tc/S11PKLauncher.exe
Resource
win7-en-20211014
Behavioral task
behavioral16
Sample
San11 Tc/S11PKLauncher.exe
Resource
win10-en-20210920
Behavioral task
behavioral17
Sample
San11 Tc/SECDRV.SYS.exe
Resource
win7-en-20211014
Behavioral task
behavioral18
Sample
San11 Tc/SECDRV.SYS.exe
Resource
win10-en-20210920
Behavioral task
behavioral19
Sample
San11 Tc/San11.exe
Resource
win7-en-20211014
Behavioral task
behavioral20
Sample
San11 Tc/San11.exe
Resource
win10-en-20210920
Behavioral task
behavioral21
Sample
San11 Tc/san11pk.exe
Resource
win7-en-20210920
Behavioral task
behavioral22
Sample
San11 Tc/san11pk.exe
Resource
win10-en-20211014
Behavioral task
behavioral23
Sample
San11 Tc/开始游戏.exe
Resource
win7-en-20210920
Behavioral task
behavioral24
Sample
San11 Tc/开始游戏.exe
Resource
win10-en-20211014
Behavioral task
behavioral25
Sample
23c9e16cc6549ca05d349e7d04805309171cfe8a8426cdb7376f2a41b757a67b.exe
Resource
win7-en-20210920
Behavioral task
behavioral26
Sample
23c9e16cc6549ca05d349e7d04805309171cfe8a8426cdb7376f2a41b757a67b.exe
Resource
win10-en-20211014
Behavioral task
behavioral27
Sample
36a18ae31faa401de370fc7c808bd43f5f7af14c9f6f71cbd2aa9f8cca6555d0.exe
Resource
win7-en-20210920
Behavioral task
behavioral28
Sample
36a18ae31faa401de370fc7c808bd43f5f7af14c9f6f71cbd2aa9f8cca6555d0.exe
Resource
win10-en-20210920
Behavioral task
behavioral29
Sample
4109a062b38d66ee7222cd984120e056acd0f5dad490c623f411c8abb18796d4.exe
Resource
win7-en-20211014
Behavioral task
behavioral30
Sample
4109a062b38d66ee7222cd984120e056acd0f5dad490c623f411c8abb18796d4.exe
Resource
win10-en-20210920
Behavioral task
behavioral31
Sample
CW3.exe
Resource
win7-en-20211014
Behavioral task
behavioral32
Sample
CW3.exe
Resource
win10-en-20210920
General
-
Target
San11 Tc/San11.exe
-
Size
5.9MB
-
MD5
07d46200af50166f44ed7208d3c65f67
-
SHA1
d9675b890bd29ff5274358083be77e9e361c7820
-
SHA256
bb0e70d0df97abb44faef927f36c2afe06bba148168aa39cc7dcf13b1ab9f651
-
SHA512
2c0757f14cea6bb7874ba82568ed4fbac61f07231924e2f9e6d26bce7df781e461bc3d9767fce445a701f43baed388929720597ac39f2c36e833dee57bff17c8
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
San11.exedescription ioc process File created C:\Windows\SysWOW64\drivers\SECDRV.SYS San11.exe File opened for modification C:\Windows\SysWOW64\drivers\SECDRV.SYS San11.exe -
Executes dropped EXE 1 IoCs
Processes:
~e5.0001pid process 4340 ~e5.0001 -
Loads dropped DLL 4 IoCs
Processes:
San11.exe~e5.0001pid process 3684 San11.exe 4340 ~e5.0001 3684 San11.exe 3684 San11.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 628 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
San11.exedescription pid process target process PID 3684 wrote to memory of 4340 3684 San11.exe ~e5.0001 PID 3684 wrote to memory of 4340 3684 San11.exe ~e5.0001 PID 3684 wrote to memory of 4340 3684 San11.exe ~e5.0001
Processes
-
C:\Users\Admin\AppData\Local\Temp\San11 Tc\San11.exe"C:\Users\Admin\AppData\Local\Temp\San11 Tc\San11.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\~e5.0001"C:\Users\Admin\AppData\Local\Temp\~e5.0001" 3684 "C:\Users\Admin\AppData\Local\Temp\""~e5.0001.dir.0000"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4340
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\~e5.0001MD5
b9bcaeca2d337cf96c490c625884e9af
SHA12d82d74410c3748a2d4634800cd6a9b9d5beec81
SHA256b3b7f9564e01ac379cb1e2bba1c7a5a1ae1627548bbad4c6a0844ca6c5c827aa
SHA512a091e3ff60d9a5fab44234c859626ee623dfe4b199c37704bd879f027ff6f8501e2b384fd0ba62319479cab92e021d5067e7ab583c505bb0d358a45692e3a981
-
C:\Users\Admin\AppData\Local\Temp\~e5.0001MD5
b9bcaeca2d337cf96c490c625884e9af
SHA12d82d74410c3748a2d4634800cd6a9b9d5beec81
SHA256b3b7f9564e01ac379cb1e2bba1c7a5a1ae1627548bbad4c6a0844ca6c5c827aa
SHA512a091e3ff60d9a5fab44234c859626ee623dfe4b199c37704bd879f027ff6f8501e2b384fd0ba62319479cab92e021d5067e7ab583c505bb0d358a45692e3a981
-
C:\Users\Admin\AppData\Local\Temp\~e5.0001.dir.0000\PfdRun.pfdMD5
0261b8f07012ab04b64daf42ea8bc092
SHA1be1ba2c62a713b3a4a8d36408f8abcb2139378f3
SHA256a3501267ef5112c0afb65fdf1d32ae4731aeaf29222ab8f2d4b450d06845efaf
SHA5125b520571a221ef9c56fc938bed4c1f33db70cc09be41e87fe5479a1aaf0c9c72d12853513b3110d7bf7a5b5178eb0c46f2bd4f3036599f0ea753a936ef46e3b0
-
C:\Users\Admin\AppData\Local\Temp\~e5.0001.dir.0000\~df394b.tmpMD5
336e3ef3db0cf3a6f4f038f92f4d2e62
SHA1e0148a28907fc2f5a28dd0ab02634352d64a5f0e
SHA25698aa5b28d050b6dcd75623a3f162aea10b5b7213e2080777d2742e96a31e3a60
SHA512aa61636cc61c8ac298f3009b0d9118a5ba91553618535226fef01b6506a11d2e4a6d09fa4add9ba7c2e2a7b30c04b6c7d4882bd24d8f4767dfc721d6399197c5
-
\Users\Admin\AppData\Local\Temp\~e5.0001.dir.0000\DrvMgt.dllMD5
9b188e6f9fac4b8fb8d536015589df37
SHA1a5247ec0ec50b8f470c93bf23e3f2514c402d5ad
SHA256538471b7ebe7db84153d4ece0012167805333152c2bf1f83c08da28945e6d85b
SHA512a6e2963bd09b0d39f7ca929ae2eba1639e6301a93755bd83f1c853f55c658936585f6171d0376ee4022a84c9be5383f4522cfc8277b51502147d88664c7063dd
-
\Users\Admin\AppData\Local\Temp\~e5.0001.dir.0000\~de13e4.tmpMD5
df52aa569acf229c80d1beef0566ef5c
SHA17107142a3a88212666845f2da78a694ca3e7594d
SHA256ec4cc717e32f1f1a07ae07805b52963ae960565dbddf2eb9d333b2fec0116bcc
SHA512878fc1f4c2ec23d9a5d259b0fc5869cb66a55008ea5ed4efead8d46c9ba6986b760644b40a50f00fcb72fe045d5c2bd2e95753d46296521797696e097684aa14
-
\Users\Admin\AppData\Local\Temp\~e5.0001.dir.0000\~df394b.tmpMD5
336e3ef3db0cf3a6f4f038f92f4d2e62
SHA1e0148a28907fc2f5a28dd0ab02634352d64a5f0e
SHA25698aa5b28d050b6dcd75623a3f162aea10b5b7213e2080777d2742e96a31e3a60
SHA512aa61636cc61c8ac298f3009b0d9118a5ba91553618535226fef01b6506a11d2e4a6d09fa4add9ba7c2e2a7b30c04b6c7d4882bd24d8f4767dfc721d6399197c5
-
\Users\Admin\AppData\Local\Temp\~e5.0001.dir.0000\~df394b.tmpMD5
336e3ef3db0cf3a6f4f038f92f4d2e62
SHA1e0148a28907fc2f5a28dd0ab02634352d64a5f0e
SHA25698aa5b28d050b6dcd75623a3f162aea10b5b7213e2080777d2742e96a31e3a60
SHA512aa61636cc61c8ac298f3009b0d9118a5ba91553618535226fef01b6506a11d2e4a6d09fa4add9ba7c2e2a7b30c04b6c7d4882bd24d8f4767dfc721d6399197c5
-
memory/3684-115-0x0000000000400000-0x0000000009B4A000-memory.dmpFilesize
151.3MB
-
memory/4340-116-0x0000000000000000-mapping.dmp