Overview
overview
9Static
static
9更多系�...�.html
windows7-x64
1更多系�...�.html
windows10-2004-x64
1q779596940_Setup.exe
windows7-x64
9q779596940_Setup.exe
windows10-2004-x64
远程监�...em.dll
windows7-x64
3远程监�...em.dll
windows10-2004-x64
3远程监�...ma.exe
windows7-x64
3远程监�...ma.exe
windows10-2004-x64
3远程监�...ib.exe
windows7-x64
3远程监�...ib.exe
windows10-2004-x64
3远程监�...ip.exe
windows7-x64
1远程监�...ip.exe
windows10-2004-x64
1远程监控/dp1.dll
windows7-x64
3远程监控/dp1.dll
windows10-2004-x64
3远程监�...72.exe
windows7-x64
8远程监�...72.exe
windows10-2004-x64
8远程监�...ln.dll
windows7-x64
1远程监�...ln.dll
windows10-2004-x64
1远程监�...��.exe
windows7-x64
3远程监�...��.exe
windows10-2004-x64
3远程监�...��.exe
windows7-x64
1远程监�...��.exe
windows10-2004-x64
1Analysis
-
max time kernel
165s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:48
Behavioral task
behavioral1
Sample
更多系统软件下载.html
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
更多系统软件下载.html
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
q779596940_Setup.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
q779596940_Setup.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
远程监控/LZMA/Plugins/System.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
远程监控/LZMA/Plugins/System.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
远程监控/LZMA/Stubs/lzma.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
远程监控/LZMA/Stubs/lzma.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
远程监控/LZMA/Stubs/zlib.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
远程监控/LZMA/Stubs/zlib.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
远程监控/LZMA/zip.exe
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
远程监控/LZMA/zip.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
远程监控/dp1.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
远程监控/dp1.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
远程监控/hbf72.exe
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
远程监控/hbf72.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
远程监控/krnln.dll
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
远程监控/krnln.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
远程监控/主控端备份.exe
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
远程监控/主控端备份.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
远程监控/附_文件捆绑器.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
远程监控/附_文件捆绑器.exe
Resource
win10v2004-20221111-en
General
-
Target
远程监控/LZMA/Plugins/System.dll
-
Size
10KB
-
MD5
0c8ea8e6637bbf8408104e672d78ba45
-
SHA1
c231c7acaf9abb7da93f28e1b71bed164d57103e
-
SHA256
509a93177a7ae130bc3b6b5ec3236c7aa0811b8b86f8ab3442c65fdf8ff85b1f
-
SHA512
ee763a3cdbbba3b28e6a903ac942c7228bd8e54b19de21d6187e481f2916d833d9b9800e5ac2998f4aa26274cdfb20a8bfdd10f00f2a15d37bcc529b617e1f28
-
SSDEEP
192:+OSsJI/rqmIDNLU0dq51EgAiNbubv68LZ:QHQQ0d01Egbq768
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2008 3500 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3900 wrote to memory of 3500 3900 rundll32.exe rundll32.exe PID 3900 wrote to memory of 3500 3900 rundll32.exe rundll32.exe PID 3900 wrote to memory of 3500 3900 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\远程监控\LZMA\Plugins\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\远程监控\LZMA\Plugins\System.dll,#12⤵PID:3500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 6123⤵
- Program crash
PID:2008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3500 -ip 35001⤵PID:3740