Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 06:57
Behavioral task
behavioral1
Sample
QQ群批量拉人软件2.1/PC协议批量拉人.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
QQ群批量拉人软件2.1/PC协议批量拉人.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
QQ群批量拉人软件2.1/UUWisehelper.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
QQ群批量拉人软件2.1/UUWisehelper.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
QQ群批量拉人软件2.1/数码资源网.url
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
QQ群批量拉人软件2.1/数码资源网.url
Resource
win10v2004-20220812-en
General
-
Target
QQ群批量拉人软件2.1/PC协议批量拉人.exe
-
Size
1.4MB
-
MD5
f115721e8a5d8715f22b33e4061595e4
-
SHA1
9bc1582ec7b4cc6af75fe54cb553b9a13bee8b9f
-
SHA256
4decb5069cc6158206a68edaafcd3eecd47db77e74402e71fefeeb49f7cb8dc5
-
SHA512
318f0d30acea729f29c1a4ce1a704afb5c90cfc1aadcbb2d0e9d7bd414f9dda568f45a307f3b9275abb5711f7e67dd771dc14114ff5bd90d91e9ad11426e2f27
-
SSDEEP
24576:ZmcCKaDZXUmX+z8MxT98FE27ud1DX078MPCbBeQRB7mO0TSBzaul1/C295:ZmcHAXU0oV98D7A1b0wMPRaB74G2ul1/
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/948-58-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-59-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-60-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-62-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-64-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-66-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-70-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-72-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-76-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-74-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-80-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-82-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-84-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-86-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-88-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-90-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-92-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-96-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-98-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-100-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-94-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-78-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-68-0x0000000000330000-0x000000000036E000-memory.dmp upx behavioral1/memory/948-108-0x0000000000330000-0x000000000036E000-memory.dmp upx -
Processes:
resource yara_rule behavioral1/memory/948-55-0x0000000000400000-0x00000000007D1000-memory.dmp vmprotect behavioral1/memory/948-57-0x0000000000400000-0x00000000007D1000-memory.dmp vmprotect behavioral1/memory/948-109-0x0000000000400000-0x00000000007D1000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
PC协议批量拉人.exedescription ioc process File opened (read-only) \??\X: PC协议批量拉人.exe File opened (read-only) \??\E: PC协议批量拉人.exe File opened (read-only) \??\H: PC协议批量拉人.exe File opened (read-only) \??\K: PC协议批量拉人.exe File opened (read-only) \??\M: PC协议批量拉人.exe File opened (read-only) \??\S: PC协议批量拉人.exe File opened (read-only) \??\T: PC协议批量拉人.exe File opened (read-only) \??\Z: PC协议批量拉人.exe File opened (read-only) \??\B: PC协议批量拉人.exe File opened (read-only) \??\J: PC协议批量拉人.exe File opened (read-only) \??\I: PC协议批量拉人.exe File opened (read-only) \??\N: PC协议批量拉人.exe File opened (read-only) \??\P: PC协议批量拉人.exe File opened (read-only) \??\R: PC协议批量拉人.exe File opened (read-only) \??\V: PC协议批量拉人.exe File opened (read-only) \??\A: PC协议批量拉人.exe File opened (read-only) \??\F: PC协议批量拉人.exe File opened (read-only) \??\O: PC协议批量拉人.exe File opened (read-only) \??\Q: PC协议批量拉人.exe File opened (read-only) \??\U: PC协议批量拉人.exe File opened (read-only) \??\W: PC协议批量拉人.exe File opened (read-only) \??\Y: PC协议批量拉人.exe File opened (read-only) \??\G: PC协议批量拉人.exe File opened (read-only) \??\L: PC协议批量拉人.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PC协议批量拉人.exedescription pid process Token: 33 948 PC协议批量拉人.exe Token: SeIncBasePriorityPrivilege 948 PC协议批量拉人.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
PC协议批量拉人.exepid process 948 PC协议批量拉人.exe 948 PC协议批量拉人.exe 948 PC协议批量拉人.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmpFilesize
8KB
-
memory/948-55-0x0000000000400000-0x00000000007D1000-memory.dmpFilesize
3.8MB
-
memory/948-57-0x0000000000400000-0x00000000007D1000-memory.dmpFilesize
3.8MB
-
memory/948-58-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-59-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-60-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-62-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-64-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-66-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-70-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-72-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-76-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-74-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-80-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-82-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-84-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-86-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-88-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-90-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-92-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-96-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-98-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-100-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-94-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-78-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-68-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-101-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/948-103-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/948-104-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/948-102-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/948-105-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/948-107-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/948-106-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/948-108-0x0000000000330000-0x000000000036E000-memory.dmpFilesize
248KB
-
memory/948-109-0x0000000000400000-0x00000000007D1000-memory.dmpFilesize
3.8MB