Analysis
-
max time kernel
104s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 07:49
Behavioral task
behavioral1
Sample
大天使之剑夜涩辅助.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
大天使之剑夜涩辅助.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
更多软件下载.url
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
更多软件下载.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
飘荡软件.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
飘荡软件.url
Resource
win10v2004-20221111-en
General
-
Target
大天使之剑夜涩辅助.exe
-
Size
5.5MB
-
MD5
8484823040622df32740e9e0b8bb221b
-
SHA1
798c495077586d8ed08d3417c959a00ba944169c
-
SHA256
d14b2204c5825f10d9aad519cdb35e9f92c71b977f87fb798923669b62f0c668
-
SHA512
3bb32eb95003d5105bb32dfff13d64c1a95516f8152a9a0b78933edca5b3e54e4d4eb7c843f546747a3fdf74ff337572d44c15ab0d0dbdc4dec579b85cd37d1b
-
SSDEEP
98304:ngj85qZ8zfRrH/LaVhnPhpC1n2420LqFtHL2d1yl/civOkzZBaWR+:ns/ZIfRzDaVhPHC1Y0LExLh+bkzZBaWR
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1832-58-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-59-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-60-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-62-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-64-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-66-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-68-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-70-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-74-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-76-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-80-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-82-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-86-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-90-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-94-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-98-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-100-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-96-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-92-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-88-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-84-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-78-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-72-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1832-101-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Processes:
resource yara_rule behavioral1/memory/1832-56-0x0000000000400000-0x0000000000F88000-memory.dmp vmprotect behavioral1/memory/1832-102-0x0000000000400000-0x0000000000F88000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
大天使之剑夜涩辅助.exepid process 1832 大天使之剑夜涩辅助.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
大天使之剑夜涩辅助.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "www.2345.com/?k1902203" 大天使之剑夜涩辅助.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
大天使之剑夜涩辅助.exepid process 1832 大天使之剑夜涩辅助.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
大天使之剑夜涩辅助.exepid process 1832 大天使之剑夜涩辅助.exe 1832 大天使之剑夜涩辅助.exe 1832 大天使之剑夜涩辅助.exe 1832 大天使之剑夜涩辅助.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1832-54-0x0000000076401000-0x0000000076403000-memory.dmpFilesize
8KB
-
memory/1832-56-0x0000000000400000-0x0000000000F88000-memory.dmpFilesize
11.5MB
-
memory/1832-58-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-59-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-60-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-62-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-64-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-66-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-68-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-70-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-74-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-76-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-80-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-82-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-86-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-90-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-94-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-98-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-100-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-96-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-92-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-88-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-84-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-78-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-72-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-101-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1832-102-0x0000000000400000-0x0000000000F88000-memory.dmpFilesize
11.5MB