Overview

overview

9

Static

static

8

三国魂�...00.exe

windows7-x64

1

三国魂�...00.exe

windows10-2004-x64

三国魂�...ar.dll

windows7-x64

3

三国魂�...ar.dll

windows10-2004-x64

3

三国魂�...te.exe

windows7-x64

8

三国魂�...te.exe

windows10-2004-x64

8

三国魂�....3.exe

windows7-x64

6

三国魂�....3.exe

windows10-2004-x64

三国魂�...��.exe

windows7-x64

8

三国魂�...��.exe

windows10-2004-x64

9

三国魂�...ml.url

windows7-x64

1

三国魂�...ml.url

windows10-2004-x64

1

Analysis

  • max time kernel
    160s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 06:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    三国魂战魂/主控台.exe

  • Size

    2.7MB

  • MD5

    bbaa354b0de6d6168e09a8a49b25bbf5

  • SHA1

    b44422d49a992b8caff25dddfd0d8fdad56fc596

  • SHA256

    e61a5b44008c8f4fd0d02b7ac6e8bcd055f0144fa8d253b20b602a89960a5557

  • SHA512

    3dc4640c7da488996c64c426eeb8e9364404e3c78d31d445c8fddaa899394cb8a88ed74e1a9b1426f35defa2b58b729a56749e866d55acc64b08fa1a4445a7d7

  • SSDEEP

    49152:LDGb1EspZ38TVtrLuNMQJ38YUtUwgwvP+3kX/KXpMZMP6Rja9hTFrgfE4kTsJNL6:CCZFjEofoIfN/dBAKaZ/pJrP

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\三国魂战魂\主控台.exe
    "C:\Users\Admin\AppData\Local\Temp\三国魂战魂\主控台.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    PID:4936
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4936 -ip 4936
    1⤵
      PID:3280

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\jedata.dll
      Filesize

      86KB

      MD5

      114054313070472cd1a6d7d28f7c5002

      SHA1

      9a044986e6101df1a126035da7326a50c3fe9a23

      SHA256

      e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

      SHA512

      a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

      Download Submit
    • memory/4936-132-0x0000000000400000-0x0000000000808000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/4936-133-0x0000000000400000-0x0000000000808000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/4936-134-0x0000000002550000-0x0000000002558000-memory.dmp
      Filesize

      32KB

      Download
    • memory/4936-136-0x0000000010000000-0x000000001003E000-memory.dmp
      Filesize

      248KB

      Download
    • memory/4936-137-0x0000000000400000-0x0000000000808000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/4936-138-0x0000000010000000-0x000000001003E000-memory.dmp
      Filesize

      248KB

      Download