Overview

overview

9

Static

static

风云江湖v2.0.exe

windows7-x64

6

风云江湖v2.0.exe

windows10-2004-x64

6

风云江湖v20.exe

windows7-x64

9

风云江湖v20.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    47s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 21:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    风云江湖v20.exe

  • Size

    1.4MB

  • MD5

    d3cc1961abc2aea0e3d96ec0d9c4f5d2

  • SHA1

    8763ee09dba17ba46b1789e90b5f16dcf1a82c53

  • SHA256

    e273d5ca175e19b6aa61cf8dfa65e1eb0ea365f923380acb9da90e009d259625

  • SHA512

    d9c2c379b2f8ecdfbf602e7387c1358b28c87655b0eabc4dbe2ef619594ba45face35fce905909ec30ff43a312f5ae9cd6510e1a9f2b7ccbb361998ab51e816d

  • SSDEEP

    24576:emTCLE9tPUmsYxDATvQnbc5Q/yLdPXlrdacBUQtRoTIZDq0jmmS:emP3P7sYpUviusyL9nTSOoTIZDqjmS

Score
9/10
evasion

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\风云江湖v20.exe
    "C:\Users\Admin\AppData\Local\Temp\风云江湖v20.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Identifies Wine through registry keys
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1544-54-0x0000000000400000-0x0000000000717000-memory.dmp
    Filesize

    3.1MB

    Download
  • memory/1544-55-0x0000000075681000-0x0000000075683000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1544-56-0x00000000774D0000-0x0000000077650000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/1544-57-0x0000000000400000-0x0000000000717000-memory.dmp
    Filesize

    3.1MB

    Download
  • memory/1544-58-0x00000000774D0000-0x0000000077650000-memory.dmp
    Filesize

    1.5MB

    Download