Overview
overview
10Static
static
8lianxuextb...��.url
windows7-x64
1lianxuextb...��.url
windows10-2004-x64
1lianxuextb...a1.exe
windows7-x64
10lianxuextb...a1.exe
windows10-2004-x64
10lianxuextb...��.exe
windows7-x64
8lianxuextb...��.exe
windows10-2004-x64
8lianxuextb...��.url
windows7-x64
1lianxuextb...��.url
windows10-2004-x64
1Analysis
-
max time kernel
153s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 23:57
Behavioral task
behavioral1
Sample
lianxuextbsq_33lc.com/3837网址导航.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
lianxuextbsq_33lc.com/3837网址导航.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
lianxuextbsq_33lc.com/lx_speed 1.5 beta1.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
lianxuextbsq_33lc.com/lx_speed 1.5 beta1.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
lianxuextbsq_33lc.com/破解补丁.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
lianxuextbsq_33lc.com/破解补丁.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
lianxuextbsq_33lc.com/绿茶软件园.url
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
lianxuextbsq_33lc.com/绿茶软件园.url
Resource
win10v2004-20220812-en
General
-
Target
lianxuextbsq_33lc.com/破解补丁.exe
-
Size
1.6MB
-
MD5
e5c0784a64ca52c3e2c932b932d439e0
-
SHA1
388ec842a606750f44def7b259d5bde604b34bfd
-
SHA256
adcade3ecfd221bfbb5cb440a4bdaa58a9b00882c63bbe37192c37143bb69094
-
SHA512
6f4f31669ef36aec896d62bcda06ad2a10b57593cd0c4dbfd62fc959df71e425c5354e6f43058b94a445c2e39f5d621a6528a42eefc5f4a8cced3e0802e5e93a
-
SSDEEP
49152:kdr+P+HQihOWHXEN5sFHeJzHgvL86rdHRz:EwihfHUw1eJrgT8Y
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral6/memory/3208-136-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-138-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-137-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-140-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-142-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-144-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-146-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-148-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-150-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-152-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-154-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-156-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-158-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-160-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-162-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-164-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-166-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-168-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-170-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-173-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-175-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-177-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-179-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx behavioral6/memory/3208-182-0x0000000000A60000-0x0000000000A9E000-memory.dmp upx -
Processes:
resource yara_rule behavioral6/memory/3208-132-0x0000000000400000-0x0000000000795000-memory.dmp vmprotect behavioral6/memory/3208-133-0x0000000000400000-0x0000000000795000-memory.dmp vmprotect behavioral6/memory/3208-135-0x0000000000400000-0x0000000000795000-memory.dmp vmprotect behavioral6/memory/3208-180-0x0000000000400000-0x0000000000795000-memory.dmp vmprotect behavioral6/memory/3208-181-0x0000000000400000-0x0000000000795000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
破解补丁.exepid process 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
破解补丁.exepid process 3208 破解补丁.exe 3208 破解补丁.exe 3208 破解补丁.exe