Overview
overview
8Static
static
8FastVerCode.dll
windows7-x64
8FastVerCode.dll
windows10-2004-x64
3ICSharpCod...ib.dll
windows7-x64
1ICSharpCod...ib.dll
windows10-2004-x64
1Interop.ADODB.dll
windows7-x64
1Interop.ADODB.dll
windows10-2004-x64
1Interop.ADOX.dll
windows7-x64
1Interop.ADOX.dll
windows10-2004-x64
1Interop.ADQX.dll
windows7-x64
8Interop.ADQX.dll
windows10-2004-x64
8Interop.ADQX64.dll
windows7-x64
1Interop.ADQX64.dll
windows10-2004-x64
1Interop.JPO.dll
windows7-x64
1Interop.JPO.dll
windows10-2004-x64
1Interop.JRO.dll
windows7-x64
1Interop.JRO.dll
windows10-2004-x64
1UUWiseHelper.dll
windows7-x64
1UUWiseHelper.dll
windows10-2004-x64
3dl.dll
windows7-x64
1dl.dll
windows10-2004-x64
1irisskin2.dll
windows7-x64
1irisskin2.dll
windows10-2004-x64
1qq_post.exe
windows7-x64
8qq_post.exe
windows10-2004-x64
8qq_post1.4...de.dll
windows7-x64
8qq_post1.4...de.dll
windows10-2004-x64
3qq_post1.4...ib.dll
windows7-x64
1qq_post1.4...ib.dll
windows10-2004-x64
1qq_post1.4...DB.dll
windows7-x64
1qq_post1.4...DB.dll
windows10-2004-x64
1qq_post1.4...OX.dll
windows7-x64
1qq_post1.4...OX.dll
windows10-2004-x64
1Analysis
-
max time kernel
33s -
max time network
103s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 17:29
Behavioral task
behavioral1
Sample
FastVerCode.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
FastVerCode.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
ICSharpCode.SharpZipLib.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Interop.ADODB.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Interop.ADODB.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Interop.ADOX.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Interop.ADOX.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Interop.ADQX.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Interop.ADQX.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Interop.ADQX64.dll
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
Interop.ADQX64.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
Interop.JPO.dll
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
Interop.JPO.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
Interop.JRO.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Interop.JRO.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
UUWiseHelper.dll
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
UUWiseHelper.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
dl.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
dl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
irisskin2.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
irisskin2.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
qq_post.exe
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
qq_post.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
qq_post1.4/FastVerCode.dll
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
qq_post1.4/FastVerCode.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
qq_post1.4/ICSharpCode.SharpZipLib.dll
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
qq_post1.4/ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral29
Sample
qq_post1.4/Interop.ADODB.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
qq_post1.4/Interop.ADODB.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral31
Sample
qq_post1.4/Interop.ADOX.dll
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
qq_post1.4/Interop.ADOX.dll
Resource
win10v2004-20220901-en
General
-
Target
Interop.JRO.dll
-
Size
9KB
-
MD5
d0f93a924b39033330bbb4773eae8aba
-
SHA1
ff32d13c54add617aacd5800afbe6227e1b1b6ef
-
SHA256
3ad1a7015fa2f1320c242f5725f2cf1311bfd5927f2feb95812691136ffbc46d
-
SHA512
44193cb7200ae9c2ed0dc4d11ac210fb8d8bc908acdcac0a3d3a69c5aed7eb982da5a4527050cff6b5903d959c706b1b963264eb3bb0dbcd50c6c44432ee093c
-
SSDEEP
96:fGdIIVk0WXq5S55KzS11HBbUw/DNEb7SPF/1E+54SGqBm4FHfnxkEsQkExar6RZx:fQWXaS5MSdbX/BzPszSGqBm4+CnZ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1476 wrote to memory of 1956 1476 rundll32.exe rundll32.exe PID 1476 wrote to memory of 1956 1476 rundll32.exe rundll32.exe PID 1476 wrote to memory of 1956 1476 rundll32.exe rundll32.exe PID 1476 wrote to memory of 1956 1476 rundll32.exe rundll32.exe PID 1476 wrote to memory of 1956 1476 rundll32.exe rundll32.exe PID 1476 wrote to memory of 1956 1476 rundll32.exe rundll32.exe PID 1476 wrote to memory of 1956 1476 rundll32.exe rundll32.exe