Analysis
-
max time kernel
148s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 06:57
Behavioral task
behavioral1
Sample
QQ群批量拉人软件2.1/PC协议批量拉人.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
QQ群批量拉人软件2.1/PC协议批量拉人.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
QQ群批量拉人软件2.1/UUWisehelper.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
QQ群批量拉人软件2.1/UUWisehelper.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
QQ群批量拉人软件2.1/数码资源网.url
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
QQ群批量拉人软件2.1/数码资源网.url
Resource
win10v2004-20220812-en
General
-
Target
QQ群批量拉人软件2.1/PC协议批量拉人.exe
-
Size
1.4MB
-
MD5
f115721e8a5d8715f22b33e4061595e4
-
SHA1
9bc1582ec7b4cc6af75fe54cb553b9a13bee8b9f
-
SHA256
4decb5069cc6158206a68edaafcd3eecd47db77e74402e71fefeeb49f7cb8dc5
-
SHA512
318f0d30acea729f29c1a4ce1a704afb5c90cfc1aadcbb2d0e9d7bd414f9dda568f45a307f3b9275abb5711f7e67dd771dc14114ff5bd90d91e9ad11426e2f27
-
SSDEEP
24576:ZmcCKaDZXUmX+z8MxT98FE27ud1DX078MPCbBeQRB7mO0TSBzaul1/C295:ZmcHAXU0oV98D7A1b0wMPRaB74G2ul1/
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/780-135-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-137-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-136-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-139-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-141-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-143-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-145-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-147-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-149-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-151-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-153-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-155-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-157-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-159-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-161-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-163-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-165-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-167-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-169-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-171-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-173-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-175-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-177-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-181-0x0000000002610000-0x000000000264E000-memory.dmp upx behavioral2/memory/780-187-0x0000000002610000-0x000000000264E000-memory.dmp upx -
Processes:
resource yara_rule behavioral2/memory/780-132-0x0000000000400000-0x00000000007D1000-memory.dmp vmprotect behavioral2/memory/780-133-0x0000000000400000-0x00000000007D1000-memory.dmp vmprotect behavioral2/memory/780-186-0x0000000000400000-0x00000000007D1000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
PC协议批量拉人.exedescription ioc process File opened (read-only) \??\Z: PC协议批量拉人.exe File opened (read-only) \??\X: PC协议批量拉人.exe File opened (read-only) \??\K: PC协议批量拉人.exe File opened (read-only) \??\P: PC协议批量拉人.exe File opened (read-only) \??\S: PC协议批量拉人.exe File opened (read-only) \??\T: PC协议批量拉人.exe File opened (read-only) \??\V: PC协议批量拉人.exe File opened (read-only) \??\J: PC协议批量拉人.exe File opened (read-only) \??\F: PC协议批量拉人.exe File opened (read-only) \??\H: PC协议批量拉人.exe File opened (read-only) \??\L: PC协议批量拉人.exe File opened (read-only) \??\M: PC协议批量拉人.exe File opened (read-only) \??\N: PC协议批量拉人.exe File opened (read-only) \??\O: PC协议批量拉人.exe File opened (read-only) \??\W: PC协议批量拉人.exe File opened (read-only) \??\A: PC协议批量拉人.exe File opened (read-only) \??\Y: PC协议批量拉人.exe File opened (read-only) \??\E: PC协议批量拉人.exe File opened (read-only) \??\G: PC协议批量拉人.exe File opened (read-only) \??\I: PC协议批量拉人.exe File opened (read-only) \??\Q: PC协议批量拉人.exe File opened (read-only) \??\R: PC协议批量拉人.exe File opened (read-only) \??\U: PC协议批量拉人.exe File opened (read-only) \??\B: PC协议批量拉人.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PC协议批量拉人.exedescription pid process Token: 33 780 PC协议批量拉人.exe Token: SeIncBasePriorityPrivilege 780 PC协议批量拉人.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
PC协议批量拉人.exepid process 780 PC协议批量拉人.exe 780 PC协议批量拉人.exe 780 PC协议批量拉人.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/780-132-0x0000000000400000-0x00000000007D1000-memory.dmpFilesize
3.8MB
-
memory/780-133-0x0000000000400000-0x00000000007D1000-memory.dmpFilesize
3.8MB
-
memory/780-135-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-137-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-136-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-139-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-141-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-143-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-145-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-147-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-149-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-151-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-153-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-155-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-157-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-159-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-161-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-163-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-165-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-167-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-169-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-171-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-173-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-175-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-177-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-179-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/780-180-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/780-182-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/780-181-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB
-
memory/780-178-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/780-183-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/780-185-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/780-184-0x0000000000401000-0x00000000004D9000-memory.dmpFilesize
864KB
-
memory/780-186-0x0000000000400000-0x00000000007D1000-memory.dmpFilesize
3.8MB
-
memory/780-187-0x0000000002610000-0x000000000264E000-memory.dmpFilesize
248KB