Overview
overview
7Static
static
1服务器软件.url
windows7-x64
1服务器软件.url
windows10-2004-x64
脚本之家.url
windows7-x64
1脚本之家.url
windows10-2004-x64
1豪迪QQ�...CK.exe
windows7-x64
7豪迪QQ�...CK.exe
windows10-2004-x64
7豪迪QQ�...er.dll
windows7-x64
1豪迪QQ�...er.dll
windows10-2004-x64
1豪迪QQ�...r1.dll
windows7-x64
1豪迪QQ�...r1.dll
windows10-2004-x64
1豪迪QQ�...og.dll
windows7-x64
1豪迪QQ�...og.dll
windows10-2004-x64
1豪迪QQ�...fo.dll
windows7-x64
6豪迪QQ�...fo.dll
windows10-2004-x64
6豪迪QQ�...CA.exe
windows7-x64
6豪迪QQ�...CA.exe
windows10-2004-x64
6豪迪QQ�...qf.exe
windows7-x64
6豪迪QQ�...qf.exe
windows10-2004-x64
6豪迪QQ�...st.exe
windows7-x64
3豪迪QQ�...st.exe
windows10-2004-x64
3Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
服务器软件.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
服务器软件.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
脚本之家.url
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
脚本之家.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/CRACK.exe
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/CRACK.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/CheckUser.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/CheckUser.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/CheckVer1.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/CheckVer1.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/Desklog.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/Desklog.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/GetInfo.dll
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/GetInfo.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/crakc_YLCA.exe
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/crakc_YLCA.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/qqqf.exe
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/qqqf.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/uninst.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/uninst.exe
Resource
win10v2004-20220812-en
General
-
Target
豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/GetInfo.dll
-
Size
41KB
-
MD5
6c9ded46c89d7f323976d021d9f2cfc3
-
SHA1
ca413c9b0e4f2b937e196c8d914c24ed18b13b4d
-
SHA256
56dabeb5edcb98556d8e9df07745c1bf7e82ae6c02d927ff3de2748741a5cfb0
-
SHA512
98f1d2645d4b20f9fb52332bbf52132d8d2aad4f4cc74cf760293be656f27160312029a7fc9c353fdf315ae7104cf71ef99299e4aa5f6d29373e45a736fa507e
-
SSDEEP
768:WCpqOQdwHPoBuUSdB6zW/U9Bok+VN5KvwEW3XkjTkd4Btd8VeGi6B8xZ:RpqOQYM9SzsoBBta78E96mxZ
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3464 wrote to memory of 3884 3464 rundll32.exe rundll32.exe PID 3464 wrote to memory of 3884 3464 rundll32.exe rundll32.exe PID 3464 wrote to memory of 3884 3464 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发器 2014-06-18绿色版\豪迪QQ群发器 2014\GetInfo.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发器 2014-06-18绿色版\豪迪QQ群发器 2014\GetInfo.dll",#12⤵
- Writes to the Master Boot Record (MBR)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3884-132-0x0000000000000000-mapping.dmp