Analysis
-
max time kernel
58s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-11-2022 06:12
General
-
Target
三国魂战魂/主控台.exe
-
Size
2.7MB
-
MD5
bbaa354b0de6d6168e09a8a49b25bbf5
-
SHA1
b44422d49a992b8caff25dddfd0d8fdad56fc596
-
SHA256
e61a5b44008c8f4fd0d02b7ac6e8bcd055f0144fa8d253b20b602a89960a5557
-
SHA512
3dc4640c7da488996c64c426eeb8e9364404e3c78d31d445c8fddaa899394cb8a88ed74e1a9b1426f35defa2b58b729a56749e866d55acc64b08fa1a4445a7d7
-
SSDEEP
49152:LDGb1EspZ38TVtrLuNMQJ38YUtUwgwvP+3kX/KXpMZMP6Rja9hTFrgfE4kTsJNL6:CCZFjEofoIfN/dBAKaZ/pJrP
Score
8/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\三国魂战魂\主控台.exe"C:\Users\Admin\AppData\Local\Temp\三国魂战魂\主控台.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1336-54-0x0000000000400000-0x0000000000808000-memory.dmpFilesize
4.0MB
-
memory/1336-55-0x00000000768A1000-0x00000000768A3000-memory.dmpFilesize
8KB
-
memory/1336-56-0x0000000000400000-0x0000000000808000-memory.dmpFilesize
4.0MB
-
memory/1336-57-0x00000000001C0000-0x00000000001C8000-memory.dmpFilesize
32KB
-
memory/1336-58-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1336-59-0x0000000000400000-0x0000000000808000-memory.dmpFilesize
4.0MB
-
memory/1336-60-0x0000000000400000-0x0000000000808000-memory.dmpFilesize
4.0MB
-
memory/1336-61-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB