Overview

overview

9

Static

static

9

雷霆之�...ad.dll

windows7-x64

1

雷霆之�...ad.dll

windows10-2004-x64

1

雷霆之�...EL.dll

windows7-x64

8

雷霆之�...EL.dll

windows10-2004-x64

8

雷霆之�...ie.dll

windows7-x64

1

雷霆之�...ie.dll

windows10-2004-x64

1

雷霆之�...p1.dll

windows7-x64

1

雷霆之�...p1.dll

windows10-2004-x64

3

雷霆之�...PI.dll

windows7-x64

1

雷霆之�...PI.dll

windows10-2004-x64

1

雷霆之�...on.exe

windows7-x64

5

雷霆之�...on.exe

windows10-2004-x64

5

雷霆之�...et.dll

windows7-x64

1

雷霆之�...et.dll

windows10-2004-x64

1

雷霆之�...ln.dll

windows7-x64

1

雷霆之�...ln.dll

windows10-2004-x64

1

雷霆之�...oe.dll

windows7-x64

1

雷霆之�...oe.dll

windows10-2004-x64

1

雷霆之�...ll.dll

windows7-x64

1

雷霆之�...ll.dll

windows10-2004-x64

1

雷霆之�...ir.dll

windows7-x64

1

雷霆之�...ir.dll

windows10-2004-x64

1

雷霆之�...��.url

windows7-x64

1

雷霆之�...��.url

windows10-2004-x64

1

雷霆之�....3.exe

windows7-x64

8

雷霆之�....3.exe

windows10-2004-x64

8

雷霆之�...��.url

windows7-x64

1

雷霆之�...��.url

windows10-2004-x64

1

Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    雷霆之怒夜涩辅助V2.3/雷霆之怒夜涩辅助V2.3.exe

  • Size

    1.8MB

  • MD5

    09be0e9da4098fd10fc3e664db9a6c76

  • SHA1

    59e70a5a5a5bfc78a83ccf55ed968ee0d40fc651

  • SHA256

    cb7d20ec893bc7f68332a4867b4074650fdf8a250a44926beae4a069e444b0cb

  • SHA512

    f69269fa538dc900e7d9579ef8d362b962cc2f6d52af49672ae8206e2741c8b3e4b0cad41b0d43a64e851403da9eeff3a62354083b4108286036579f47833829

  • SSDEEP

    24576:g3iFu/RkAgSl+I7CfHhZ/uOHTLXs/nGRMItConG3CgOuKrMA3jIEPn7:gSY/RkdHD8i9nKOuYTl

Score
8/10
upxvmprotect

Malware Config

Signatures

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\雷霆之怒夜涩辅助V2.3.exe
    "C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\雷霆之怒夜涩辅助V2.3.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Internet Explorer start page
    • Suspicious use of SetWindowsHookEx
    PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2164-132-0x0000000000400000-0x000000000060E000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2164-134-0x0000000000400000-0x000000000060E000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2164-135-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-136-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-137-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-139-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-143-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-141-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-145-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-147-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-149-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-151-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-153-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-155-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-157-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-159-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-161-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-163-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-165-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-167-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-169-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-171-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-173-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-175-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-177-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-178-0x0000000010000000-0x000000001003D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/2164-179-0x0000000000400000-0x000000000060E000-memory.dmp
    Filesize

    2.1MB

    Download