Overview
overview
10Static
static
10冰封免�...m2.dll
windows7-x64
8冰封免�...m2.dll
windows10-2004-x64
8冰封免�...ar.dll
windows7-x64
3冰封免�...ar.dll
windows10-2004-x64
3冰封免�...ll.dll
windows7-x64
1冰封免�...ll.dll
windows10-2004-x64
1冰封免�...fo.dll
windows7-x64
1冰封免�...fo.dll
windows10-2004-x64
3冰封免�...ua.dll
windows7-x64
3冰封免�...ua.dll
windows10-2004-x64
3冰封免�...om.exe
windows7-x64
6冰封免�...om.exe
windows10-2004-x64
6冰封免�...om.dll
windows7-x64
1冰封免�...om.dll
windows10-2004-x64
1冰封免�...jx.dll
windows7-x64
3冰封免�...jx.dll
windows10-2004-x64
1冰封免�...ky.dll
windows7-x64
1冰封免�...ky.dll
windows10-2004-x64
1冰封免�...ty.exe
windows7-x64
5冰封免�...ty.exe
windows10-2004-x64
5冰封免�...ty.dll
windows7-x64
1冰封免�...ty.dll
windows10-2004-x64
1冰封免�...te.exe
windows7-x64
8冰封免�...te.exe
windows10-2004-x64
8冰封免�...ws.dll
windows7-x64
1冰封免�...ws.dll
windows10-2004-x64
1冰封免�...ip.exe
windows7-x64
8冰封免�...ip.exe
windows10-2004-x64
8冰封免�...��.url
windows7-x64
1冰封免�...��.url
windows10-2004-x64
1冰封免�...��.url
windows7-x64
1冰封免�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 18:37
Behavioral task
behavioral1
Sample
冰封免费版(请关闭杀毒软件下载)/3km2.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
冰封免费版(请关闭杀毒软件下载)/3km2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
冰封免费版(请关闭杀毒软件下载)/Astar.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
冰封免费版(请关闭杀毒软件下载)/Astar.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
冰封免费版(请关闭杀毒软件下载)/Dll.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
冰封免费版(请关闭杀毒软件下载)/Dll.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
冰封免费版(请关闭杀毒软件下载)/GetInfo.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
冰封免费版(请关闭杀毒软件下载)/GetInfo.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
冰封免费版(请关闭杀毒软件下载)/Lua.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
冰封免费版(请关闭杀毒软件下载)/Lua.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
冰封免费版(请关闭杀毒软件下载)/gom.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
冰封免费版(请关闭杀毒软件下载)/gom.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
冰封免费版(请关闭杀毒软件下载)/gom.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
冰封免费版(请关闭杀毒软件下载)/gom.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
冰封免费版(请关闭杀毒软件下载)/jx.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
冰封免费版(请关闭杀毒软件下载)/jx.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
冰封免费版(请关闭杀毒软件下载)/sky.dll
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
冰封免费版(请关闭杀毒软件下载)/sky.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
冰封免费版(请关闭杀毒软件下载)/ty.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
冰封免费版(请关闭杀毒软件下载)/ty.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
冰封免费版(请关闭杀毒软件下载)/ty.dll
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
冰封免费版(请关闭杀毒软件下载)/ty.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
冰封免费版(请关闭杀毒软件下载)/update.exe
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
冰封免费版(请关闭杀毒软件下载)/update.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
冰封免费版(请关闭杀毒软件下载)/ws.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
冰封免费版(请关闭杀毒软件下载)/ws.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
冰封免费版(请关闭杀毒软件下载)/冰封vip.exe
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
冰封免费版(请关闭杀毒软件下载)/冰封vip.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
冰封免费版(请关闭杀毒软件下载)/冰封官方网站.url
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
冰封免费版(请关闭杀毒软件下载)/冰封官方网站.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
冰封免费版(请关闭杀毒软件下载)/冰封教程,很全面点击打开.url
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
冰封免费版(请关闭杀毒软件下载)/冰封教程,很全面点击打开.url
Resource
win10v2004-20220812-en
General
-
Target
冰封免费版(请关闭杀毒软件下载)/3km2.dll
-
Size
1.5MB
-
MD5
2e5ff9dc7ea781a0d99895d318af3cef
-
SHA1
c2dddda1b2141a8d8fe2bd4619caffa4056e0737
-
SHA256
6d884320514ec3a9dbb66914eebbe03e66dd3623f124988d350dc6322b76098a
-
SHA512
fa0eccd58a8b7dbf8681547bc344d622391219fae1fa20eed3d7d67efa494e7f23c8670ad663ec35e4e1bb533c5ab7c784b195c5e96f7c954c45b7b2bbd50276
-
SSDEEP
49152:zJ58ZHuvPUbFLfdwDclKIM3IMhWaz0I0:D8ZHuvPUtQclPM3IMhWaj
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4712-134-0x0000000010000000-0x00000000101BF000-memory.dmp vmprotect behavioral2/memory/4712-135-0x0000000010000000-0x00000000101BF000-memory.dmp vmprotect behavioral2/memory/4712-136-0x0000000010000000-0x00000000101BF000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 4712 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 4712 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4752 wrote to memory of 4712 4752 rundll32.exe rundll32.exe PID 4752 wrote to memory of 4712 4752 rundll32.exe rundll32.exe PID 4752 wrote to memory of 4712 4752 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\3km2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\3km2.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4712
-