Overview
overview
9Static
static
9�...PI.dll
windows7-x64
6�...PI.dll
windows10-2004-x64
6�...te.exe
windows7-x64
1�...te.exe
windows10-2004-x64
1�...th.dll
windows7-x64
8�...th.dll
windows10-2004-x64
8�...ts.exe
windows7-x64
8�...ts.exe
windows10-2004-x64
8�...ok.dll
windows7-x64
8�...ok.dll
windows10-2004-x64
8�...st.dll
windows7-x64
8�...st.dll
windows10-2004-x64
8�...��.exe
windows7-x64
9�...��.exe
windows10-2004-x64
9�...��.exe
windows7-x64
1�...��.exe
windows10-2004-x64
1�...��.bat
windows7-x64
1�...��.bat
windows10-2004-x64
1�...��.bat
windows7-x64
1�...��.bat
windows10-2004-x64
1Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 22:40
Behavioral task
behavioral1
Sample
ʹ֮/CrackCaptchaAPI.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ʹ֮/CrackCaptchaAPI.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
ʹ֮/Update.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
ʹ֮/Update.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
ʹ֮/VAuth.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
ʹ֮/VAuth.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
ʹ֮/dts.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
ʹ֮/dts.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
ʹ֮/hook.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
ʹ֮/hook.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
ʹ֮/test.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
ʹ֮/test.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
ʹ֮/ƶ.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
ʹ֮/ƶ.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
ʹ֮/ƽⲹ.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
ʹ֮/ƽⲹ.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
ʹ֮/ֶɾ.bat
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
ʹ֮/ֶɾ.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
ʹ֮/ֶע.bat
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
ʹ֮/ֶע.bat
Resource
win10v2004-20220812-en
General
-
Target
ʹ֮/hook.dll
-
Size
780KB
-
MD5
d689f4979d99dc5627c7b28c57c24a52
-
SHA1
70b153e20e1b21807b76a0af57e55a4c3ef4c688
-
SHA256
96305bd113673cab2dcc7180997b4500235bb509fb68c144535401c6510a8332
-
SHA512
95d20816fa0d21354c5c6303ebe246add92c9f8bb8628106f2c6099013a97451f5e9a0356cfc14332ebe53f94e06e77f4deabac8feb4677b5d8ebf02a885e24e
-
SSDEEP
6144:ipUM6WA/ODBnKApJuyvNmxBnutFatR5EVFMNjM6sF7/Ts/IzemYRX/9QvCKXxaPS:ipYWDBnKggI2QzKEFwj6Bo/Y3m96G3K
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 4 1952 rundll32.exe 5 1952 rundll32.exe 7 1952 rundll32.exe 9 1952 rundll32.exe -
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e rundll32.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
rundll32.exepid process 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 1952 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 896 wrote to memory of 1952 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 1952 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 1952 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 1952 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 1952 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 1952 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 1952 896 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ʹ֮\hook.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ʹ֮\hook.dll,#12⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1952
-