Overview
overview
8Static
static
ERawSock.dll
windows7-x64
1ERawSock.dll
windows10-2004-x64
1EThread.dll
windows7-x64
1EThread.dll
windows10-2004-x64
1UUWiseHelper.dll
windows7-x64
1UUWiseHelper.dll
windows10-2004-x64
3ZMApi.dll
windows7-x64
1ZMApi.dll
windows10-2004-x64
1ZMApiUpdate.exe
windows7-x64
1ZMApiUpdate.exe
windows10-2004-x64
1const.dll
windows7-x64
1const.dll
windows10-2004-x64
1dp1.dll
windows7-x64
3dp1.dll
windows10-2004-x64
3eAPI.dll
windows7-x64
1eAPI.dll
windows10-2004-x64
1iext.dll
windows7-x64
1iext.dll
windows10-2004-x64
1internet.dll
windows7-x64
1internet.dll
windows10-2004-x64
1krnln.dll
windows7-x64
1krnln.dll
windows10-2004-x64
1script.dll
windows7-x64
1script.dll
windows10-2004-x64
1shell.dll
windows7-x64
1shell.dll
windows10-2004-x64
1spec.dll
windows7-x64
1spec.dll
windows10-2004-x64
1ԵQQ...��.exe
windows7-x64
8ԵQQ...��.exe
windows10-2004-x64
8Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 05:50
Static task
static1
Behavioral task
behavioral1
Sample
ERawSock.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ERawSock.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
EThread.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
EThread.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
UUWiseHelper.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
UUWiseHelper.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
ZMApi.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
ZMApi.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
ZMApiUpdate.exe
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
ZMApiUpdate.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
const.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
const.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
dp1.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
dp1.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
eAPI.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
eAPI.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
iext.dll
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
iext.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
internet.dll
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
internet.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
krnln.dll
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
krnln.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
script.dll
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
script.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
shell.dll
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
shell.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
spec.dll
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
spec.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
ԵQQȺѰ.exe
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
ԵQQȺѰ.exe
Resource
win10v2004-20220812-en
General
-
Target
ԵQQȺѰ.exe
-
Size
18KB
-
MD5
7bbb08bf1c4f85aa3dad85207fd2b4e5
-
SHA1
88e177e3606289ee18814317762e54d00cb2df94
-
SHA256
7af5312871230d82202e040567a5053a5a3f325b9946e2925bce86364b19c143
-
SHA512
c7641e868abc5e6b209e15679f92340340ed4a62d6173bc06764ce4943b3683f33eb965199613b7250fd84c5b23f104a5ad0d00e8641d9eb754abd926aa8ef09
-
SSDEEP
384:2mECh9LLRctSwqrLQU5B+SS6nl9wv6Ohttitcv9BCGRw2qp:2aFLRctSwqr0U3+wyBdb9Rsp
Malware Config
Signatures
-
resource yara_rule behavioral30/memory/5072-134-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-135-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-136-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-138-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-140-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-142-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-144-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-146-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-148-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-150-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-152-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-154-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-156-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-158-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-160-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-162-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-164-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-166-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-168-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-170-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-172-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-174-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-176-0x00000000025B0000-0x00000000025EF000-memory.dmp upx behavioral30/memory/5072-177-0x00000000025B0000-0x00000000025EF000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 33 IoCs
pid Process 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe 5072 ԵQQȺѰ.exe