Overview
overview
9Static
static
8三国魂�...00.exe
windows7-x64
1三国魂�...00.exe
windows10-2004-x64
三国魂�...ar.dll
windows7-x64
3三国魂�...ar.dll
windows10-2004-x64
3三国魂�...te.exe
windows7-x64
8三国魂�...te.exe
windows10-2004-x64
8三国魂�....3.exe
windows7-x64
6三国魂�....3.exe
windows10-2004-x64
三国魂�...��.exe
windows7-x64
8三国魂�...��.exe
windows10-2004-x64
9三国魂�...ml.url
windows7-x64
1三国魂�...ml.url
windows10-2004-x64
1Analysis
-
max time kernel
126s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 06:05
Behavioral task
behavioral1
Sample
三国魂战魂/basedb/查ID所在的文件000.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
三国魂战魂/basedb/查ID所在的文件000.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
三国魂战魂/unrar.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
三国魂战魂/unrar.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
三国魂战魂/update.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
三国魂战魂/update.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
三国魂战魂/三国魂_战魂_V 1.7.3.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
三国魂战魂/三国魂_战魂_V 1.7.3.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
三国魂战魂/主控台.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
三国魂战魂/主控台.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
三国魂战魂/会员卡密购买.html.url
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
三国魂战魂/会员卡密购买.html.url
Resource
win10v2004-20220812-en
General
-
Target
三国魂战魂/三国魂_战魂_V 1.7.3.exe
-
Size
2.6MB
-
MD5
765d894c60fbff7aa536d7f0ecb6e030
-
SHA1
f04e905804df6f7f985d62480b7f749a2d5a8d67
-
SHA256
697b62c15f7596f22f228cbaea8d71649bbe1b1701d5577e2202ddd0580a6b78
-
SHA512
5dbce52405d3447b07a042448eb6884b3646a3b930f5d4041a3658d4d6cab4fccbe4cf07661a3a5bc4b9c180e37f0cac1f1cfd906a8e161b8e3b590f5e21152f
-
SSDEEP
49152:duGb1EbpEc7AV6r+VNMnJA8BpuU9v/APd3XX6n8pQ/+NXEXA76xT1HhNI5vKzHo5:Ze/MUQ76N1Hs5vXN3MwbLm9TePDVr
Malware Config
Signatures
-
Processes:
三国魂_战魂_V 1.7.3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 三国魂_战魂_V 1.7.3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
三国魂_战魂_V 1.7.3.exepid process 1676 三国魂_战魂_V 1.7.3.exe 1676 三国魂_战魂_V 1.7.3.exe 1676 三国魂_战魂_V 1.7.3.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
三国魂_战魂_V 1.7.3.exepid process 1676 三国魂_战魂_V 1.7.3.exe 1676 三国魂_战魂_V 1.7.3.exe 1676 三国魂_战魂_V 1.7.3.exe 1676 三国魂_战魂_V 1.7.3.exe 1676 三国魂_战魂_V 1.7.3.exe