Overview
overview
3Static
static
EXEPackage...er.chm
windows7-x64
1EXEPackage...er.chm
windows10-2004-x64
1EXEPackage...er.exe
windows7-x64
3EXEPackage...er.exe
windows10-2004-x64
3EXEPackage...er.exe
windows7-x64
3EXEPackage...er.exe
windows10-2004-x64
3EXEPackage...er.dat
windows7-x64
3EXEPackage...er.dat
windows10-2004-x64
3EXEPackage...��.exe
windows7-x64
3EXEPackage...��.exe
windows10-2004-x64
3Analysis
-
max time kernel
136s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:05
Static task
static1
Behavioral task
behavioral1
Sample
EXEPackager/EXEPackager.chm
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
EXEPackager/EXEPackager.chm
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
EXEPackager/EXEPackager.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
EXEPackager/EXEPackager.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
EXEPackager/exeplayer.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
EXEPackager/exeplayer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
EXEPackager/nsFLVPlayer.dat
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
EXEPackager/nsFLVPlayer.dat
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
EXEPackager/样本/《银狐》片头.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
EXEPackager/样本/《银狐》片头.exe
Resource
win10v2004-20221111-en
General
-
Target
EXEPackager/exeplayer.exe
-
Size
331KB
-
MD5
b4c13f9749f28cb66fadc9e1ea48caef
-
SHA1
4ea8fb495da184780a6d2239ea722d203065d72b
-
SHA256
304c60fc47dec2b7dada88de5b7564cdc1cee643bc744c207e285f7cba58c217
-
SHA512
57b2ea0c74d786ce0f09c4076521d2fc8cdfa58b872895a75c41bd9e749808a29da3d8425e1caefb153fcc75f1d71c0ea955de25ba775a9291c0f681502fc6f8
-
SSDEEP
6144:cGbQuXWS7OXUbEdQKICbNdEOyOZH2XH+nwo0BBTO7bJnQoO4FsfkaLzEFm:3b5XhAUSQkbNdEODW3+nwj7kDOuaLoE
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2268 4928 WerFault.exe exeplayer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXEPackager\exeplayer.exe"C:\Users\Admin\AppData\Local\Temp\EXEPackager\exeplayer.exe"1⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 7522⤵
- Program crash
PID:2268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4928 -ip 49281⤵PID:4392