Overview
overview
10Static
static
8mirserver/...er.exe
windows7-x64
1mirserver/...er.exe
windows10-2004-x64
mirserver/...er.exe
windows7-x64
1mirserver/...er.exe
windows10-2004-x64
1mirserver/...er.exe
windows7-x64
1mirserver/...er.exe
windows10-2004-x64
1mirserver/...te.exe
windows7-x64
mirserver/...te.exe
windows10-2004-x64
1mirserver/...rv.exe
windows7-x64
1mirserver/...rv.exe
windows10-2004-x64
mirserver/...��.htm
windows7-x64
10mirserver/...��.htm
windows10-2004-x64
1mirserver/...tm.url
windows7-x64
1mirserver/...tm.url
windows10-2004-x64
1mirserver/...tm.url
windows7-x64
1mirserver/...tm.url
windows10-2004-x64
mirserver/...ml.url
windows7-x64
1mirserver/...ml.url
windows10-2004-x64
1mirserver/...��.url
windows7-x64
1mirserver/...��.url
windows10-2004-x64
1mirserver/...gm.dll
windows7-x64
5mirserver/...gm.dll
windows10-2004-x64
5mirserver/...al.dll
windows7-x64
1mirserver/...al.dll
windows10-2004-x64
1mirserver/...er.exe
windows7-x64
6mirserver/...er.exe
windows10-2004-x64
5mirserver/...��.htm
windows7-x64
10mirserver/...��.htm
windows10-2004-x64
1mirserver/...��.htm
windows7-x64
10mirserver/...��.htm
windows10-2004-x64
1mirserver/...te.exe
windows7-x64
1mirserver/...te.exe
windows10-2004-x64
1Analysis
-
max time kernel
137s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:54
Behavioral task
behavioral1
Sample
mirserver/DBServer/DBServer.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
mirserver/DBServer/DBServer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
mirserver/GameCenter.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
mirserver/GameCenter.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
mirserver/LogServer/LogDataServer.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
mirserver/LogServer/LogDataServer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
mirserver/LoginGate/LoginGate.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
mirserver/LoginGate/LoginGate.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
mirserver/LoginSrv/LoginSrv.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
mirserver/LoginSrv/LoginSrv.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
mirserver/LoginSrv/Readme-˵.htm
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
mirserver/LoginSrv/Readme-˵.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
mirserver/LoginSrv/Ҫϰ汾.htm.url
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
mirserver/LoginSrv/Ҫϰ汾.htm.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
mirserver/LoginSrv/÷.htm.url
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
mirserver/LoginSrv/÷.htm.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
mirserver/LoginSrv/ҵ汾.html.url
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
mirserver/LoginSrv/ҵ汾.html.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
mirserver/LoginSrv/.url
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
mirserver/LoginSrv/.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
mirserver/Mir200/000gm.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
mirserver/Mir200/000gm.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
mirserver/Mir200/IPLocal.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
mirserver/Mir200/IPLocal.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
mirserver/Mir200/M2Server.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
mirserver/Mir200/M2Server.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
mirserver/Readme-˵.htm
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
mirserver/Readme-˵.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
mirserver/RunGate/Readme-˵.htm
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
mirserver/RunGate/Readme-˵.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
mirserver/RunGate/RunGate.exe
Resource
win7-20221111-en
Behavioral task
behavioral32
Sample
mirserver/RunGate/RunGate.exe
Resource
win10v2004-20221111-en
General
-
Target
mirserver/Readme-˵.htm
-
Size
2KB
-
MD5
f2a6a504c4cb797f79e3106308f94de3
-
SHA1
a7d1a768851cd1a28901a4f2cdbc4c8fe4587818
-
SHA256
894a0efcd35d56c800cdb80d7cc776c7c6026a2383b7e1c8c718ec53f01fdf94
-
SHA512
1c9b9f0dc4491c108aae2ad15e2f7beca77504165546c8a4d8dfe77f8a4adb2a306b4f7e656153a03fa0067cdea555879c68b9f12c079a484f09139e0939d3c5
Malware Config
Signatures
-
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998397" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5CDFC1D4-6B70-11ED-AECB-F6A3911CAFFB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "538761469" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998397" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5CDFC1D6-6B70-11ED-AECB-F6A3911CAFFB}.dat = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "538761469" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
iexplore.exepid process 1232 iexplore.exe 1232 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 1232 wrote to memory of 3532 1232 iexplore.exe IEXPLORE.EXE PID 1232 wrote to memory of 3532 1232 iexplore.exe IEXPLORE.EXE PID 1232 wrote to memory of 3532 1232 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\mirserver\Readme-˵.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:17410 /prefetch:22⤵PID:3532