Overview
overview
8Static
static
8EThread.dll
windows7-x64
1EThread.dll
windows10-2004-x64
1HtmlView.dll
windows7-x64
1HtmlView.dll
windows10-2004-x64
1dp1.dll
windows7-x64
1dp1.dll
windows10-2004-x64
3eAPI.dll
windows7-x64
1eAPI.dll
windows10-2004-x64
1iext.dll
windows7-x64
1iext.dll
windows10-2004-x64
1internet.dll
windows7-x64
1internet.dll
windows10-2004-x64
1krnln.dll
windows7-x64
1krnln.dll
windows10-2004-x64
1shellEx.dll
windows7-x64
1shellEx.dll
windows10-2004-x64
1sock.dll
windows7-x64
1sock.dll
windows10-2004-x64
1spec.dll
windows7-x64
1spec.dll
windows10-2004-x64
1下载王�...om.url
windows7-x64
1下载王�...om.url
windows10-2004-x64
1酷奇自�...��.exe
windows7-x64
8酷奇自�...��.exe
windows10-2004-x64
8Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 04:44
Behavioral task
behavioral1
Sample
EThread.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
EThread.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
HtmlView.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
HtmlView.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
dp1.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
dp1.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
eAPI.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
eAPI.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
iext.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
iext.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
internet.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
internet.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
krnln.dll
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
krnln.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
shellEx.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
shellEx.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
sock.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
sock.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
spec.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
spec.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
下载王绿色软件站- xzking.com.url
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
下载王绿色软件站- xzking.com.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
酷奇自动qq消息软件V1.2破解版.exe
Resource
win7-20221111-en
General
-
Target
酷奇自动qq消息软件V1.2破解版.exe
-
Size
1.4MB
-
MD5
deff14023eb246e1cb0ca4c49e7925e2
-
SHA1
fdfc8aa85224fa5f35ce12a473a319ee05ef8056
-
SHA256
ddc2bdeba010849db93a76d042db74d311c2863e3887b0522c31af5246f01826
-
SHA512
2f65fd79491a209d5ee8bca91460913b165d71ecd38934aa309310366d4c067e2afe69c2e3de7273fcd0291ed4cd115a762ff9f09c4e792931ee537502419c02
-
SSDEEP
24576:oUjatLwHgHmB2dDsh0PNLgesaMDzSlKYdxDNXGR/IZcKk7X7Or8jQaH:oGbIdDtNLgesr3mKCxxXQIZkZ
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral24/memory/1748-137-0x0000000004B50000-0x0000000004B90000-memory.dmp upx behavioral24/memory/1748-141-0x0000000004B50000-0x0000000004B90000-memory.dmp upx behavioral24/memory/1748-142-0x0000000004B50000-0x0000000004B90000-memory.dmp upx -
Processes:
resource yara_rule behavioral24/memory/1748-132-0x0000000000400000-0x00000000006C5000-memory.dmp vmprotect behavioral24/memory/1748-143-0x0000000000400000-0x00000000006C5000-memory.dmp vmprotect -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4904 1748 WerFault.exe 酷奇自动qq消息软件V1.2破解版.exe -
Suspicious use of SetWindowsHookEx 44 IoCs
Processes:
酷奇自动qq消息软件V1.2破解版.exepid process 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe 1748 酷奇自动qq消息软件V1.2破解版.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\酷奇自动qq消息软件V1.2破解版.exe"C:\Users\Admin\AppData\Local\Temp\酷奇自动qq消息软件V1.2破解版.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 15082⤵
- Program crash
PID:4904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1748 -ip 17481⤵PID:4980
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1748-132-0x0000000000400000-0x00000000006C5000-memory.dmpFilesize
2.8MB
-
memory/1748-133-0x0000000002510000-0x0000000002554000-memory.dmpFilesize
272KB
-
memory/1748-135-0x0000000002580000-0x00000000025BB000-memory.dmpFilesize
236KB
-
memory/1748-137-0x0000000004B50000-0x0000000004B90000-memory.dmpFilesize
256KB
-
memory/1748-141-0x0000000004B50000-0x0000000004B90000-memory.dmpFilesize
256KB
-
memory/1748-142-0x0000000004B50000-0x0000000004B90000-memory.dmpFilesize
256KB
-
memory/1748-143-0x0000000000400000-0x00000000006C5000-memory.dmpFilesize
2.8MB