c2d7bd36651438dc46e8519dcaccff7fbbe838ee3e9b7f875893c7cf9a3493a1

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hxsyfzgj_56086/YY幻想神域辅助0804/ds30.exe
Size

310KB
MD5

98020f9f4642ab00241e178e2be24004
SHA1

b42a0acf49684c2e0a1e1113bfe9a95bee176557
SHA256

536bc3ca62cddf208dde98cc305c6c8e0f26d92a9894deaaa488a6adf5a0712c
SHA512

9732a7900776306a57eec2d5f0b02d2685a394b63f483fac43c722523b75ff4440796a843ef6ba1b382b79c0da8404c05cf92f85666a0aace68520d7e8a5dd2f
SSDEEP

3072:qqInBS4xvS1OsBAzdkAAO9ly4SjvSedc9NjorpqhO3ma:qHLsBAzdkAAUy4Sjzdc9N8V7

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1348	ds30.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe
1348	ds30.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	ds30.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 368	1348	ds30.exe	5
PID 1348 wrote to memory of 368	1348	ds30.exe	5
PID 1348 wrote to memory of 368	1348	ds30.exe	5
PID 1348 wrote to memory of 368	1348	ds30.exe	5
PID 1348 wrote to memory of 368	1348	ds30.exe	5
PID 1348 wrote to memory of 368	1348	ds30.exe	5
PID 1348 wrote to memory of 376	1348	ds30.exe	4
PID 1348 wrote to memory of 376	1348	ds30.exe	4
PID 1348 wrote to memory of 376	1348	ds30.exe	4
PID 1348 wrote to memory of 376	1348	ds30.exe	4
PID 1348 wrote to memory of 376	1348	ds30.exe	4
PID 1348 wrote to memory of 376	1348	ds30.exe	4
PID 1348 wrote to memory of 416	1348	ds30.exe	3
PID 1348 wrote to memory of 416	1348	ds30.exe	3
PID 1348 wrote to memory of 416	1348	ds30.exe	3
PID 1348 wrote to memory of 416	1348	ds30.exe	3
PID 1348 wrote to memory of 416	1348	ds30.exe	3
PID 1348 wrote to memory of 416	1348	ds30.exe	3
PID 1348 wrote to memory of 460	1348	ds30.exe	2
PID 1348 wrote to memory of 460	1348	ds30.exe	2
PID 1348 wrote to memory of 460	1348	ds30.exe	2
PID 1348 wrote to memory of 460	1348	ds30.exe	2
PID 1348 wrote to memory of 460	1348	ds30.exe	2
PID 1348 wrote to memory of 460	1348	ds30.exe	2
PID 1348 wrote to memory of 476	1348	ds30.exe	1
PID 1348 wrote to memory of 476	1348	ds30.exe	1
PID 1348 wrote to memory of 476	1348	ds30.exe	1
PID 1348 wrote to memory of 476	1348	ds30.exe	1
PID 1348 wrote to memory of 476	1348	ds30.exe	1
PID 1348 wrote to memory of 476	1348	ds30.exe	1
PID 1348 wrote to memory of 484	1348	ds30.exe	8
PID 1348 wrote to memory of 484	1348	ds30.exe	8
PID 1348 wrote to memory of 484	1348	ds30.exe	8
PID 1348 wrote to memory of 484	1348	ds30.exe	8
PID 1348 wrote to memory of 484	1348	ds30.exe	8
PID 1348 wrote to memory of 484	1348	ds30.exe	8
PID 1348 wrote to memory of 600	1348	ds30.exe	25
PID 1348 wrote to memory of 600	1348	ds30.exe	25
PID 1348 wrote to memory of 600	1348	ds30.exe	25
PID 1348 wrote to memory of 600	1348	ds30.exe	25
PID 1348 wrote to memory of 600	1348	ds30.exe	25
PID 1348 wrote to memory of 600	1348	ds30.exe	25
PID 1348 wrote to memory of 680	1348	ds30.exe	24
PID 1348 wrote to memory of 680	1348	ds30.exe	24
PID 1348 wrote to memory of 680	1348	ds30.exe	24
PID 1348 wrote to memory of 680	1348	ds30.exe	24
PID 1348 wrote to memory of 680	1348	ds30.exe	24
PID 1348 wrote to memory of 680	1348	ds30.exe	24
PID 1348 wrote to memory of 752	1348	ds30.exe	23
PID 1348 wrote to memory of 752	1348	ds30.exe	23
PID 1348 wrote to memory of 752	1348	ds30.exe	23
PID 1348 wrote to memory of 752	1348	ds30.exe	23
PID 1348 wrote to memory of 752	1348	ds30.exe	23
PID 1348 wrote to memory of 752	1348	ds30.exe	23
PID 1348 wrote to memory of 812	1348	ds30.exe	22
PID 1348 wrote to memory of 812	1348	ds30.exe	22
PID 1348 wrote to memory of 812	1348	ds30.exe	22
PID 1348 wrote to memory of 812	1348	ds30.exe	22
PID 1348 wrote to memory of 812	1348	ds30.exe	22
PID 1348 wrote to memory of 812	1348	ds30.exe	22
PID 1348 wrote to memory of 852	1348	ds30.exe	21
PID 1348 wrote to memory of 852	1348	ds30.exe	21
PID 1348 wrote to memory of 852	1348	ds30.exe	21
PID 1348 wrote to memory of 852	1348	ds30.exe	21

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:876
- - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    PID:2008
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1584
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1876
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1156
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1068
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1052
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:336
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:852
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:752
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:680
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:376
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:368

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\ds30.exe
  "C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\ds30.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-54-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1348-55-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download