Analysis
-
max time kernel
180s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 07:49
Behavioral task
behavioral1
Sample
大天使之剑夜涩辅助.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
大天使之剑夜涩辅助.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
更多软件下载.url
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
更多软件下载.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
飘荡软件.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
飘荡软件.url
Resource
win10v2004-20221111-en
General
-
Target
大天使之剑夜涩辅助.exe
-
Size
5.5MB
-
MD5
8484823040622df32740e9e0b8bb221b
-
SHA1
798c495077586d8ed08d3417c959a00ba944169c
-
SHA256
d14b2204c5825f10d9aad519cdb35e9f92c71b977f87fb798923669b62f0c668
-
SHA512
3bb32eb95003d5105bb32dfff13d64c1a95516f8152a9a0b78933edca5b3e54e4d4eb7c843f546747a3fdf74ff337572d44c15ab0d0dbdc4dec579b85cd37d1b
-
SSDEEP
98304:ngj85qZ8zfRrH/LaVhnPhpC1n2420LqFtHL2d1yl/civOkzZBaWR+:ns/ZIfRzDaVhPHC1Y0LExLh+bkzZBaWR
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1676-134-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-135-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-136-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-139-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-141-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-144-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-146-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-148-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-150-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-152-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-154-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-156-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-158-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-160-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-162-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-164-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-166-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-168-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-170-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-172-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-174-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-176-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-178-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1676-181-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Processes:
resource yara_rule behavioral2/memory/1676-132-0x0000000000400000-0x0000000000F88000-memory.dmp vmprotect behavioral2/memory/1676-138-0x0000000000400000-0x0000000000F88000-memory.dmp vmprotect behavioral2/memory/1676-143-0x0000000000400000-0x0000000000F88000-memory.dmp vmprotect behavioral2/memory/1676-179-0x0000000000400000-0x0000000000F88000-memory.dmp vmprotect behavioral2/memory/1676-180-0x0000000000400000-0x0000000000F88000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
大天使之剑夜涩辅助.exepid process 1676 大天使之剑夜涩辅助.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
大天使之剑夜涩辅助.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.2345.com/?k1902203" 大天使之剑夜涩辅助.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
大天使之剑夜涩辅助.exepid process 1676 大天使之剑夜涩辅助.exe 1676 大天使之剑夜涩辅助.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
大天使之剑夜涩辅助.exepid process 1676 大天使之剑夜涩辅助.exe 1676 大天使之剑夜涩辅助.exe 1676 大天使之剑夜涩辅助.exe 1676 大天使之剑夜涩辅助.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1676-132-0x0000000000400000-0x0000000000F88000-memory.dmpFilesize
11.5MB
-
memory/1676-134-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-135-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-136-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-138-0x0000000000400000-0x0000000000F88000-memory.dmpFilesize
11.5MB
-
memory/1676-139-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-141-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-143-0x0000000000400000-0x0000000000F88000-memory.dmpFilesize
11.5MB
-
memory/1676-144-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-146-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-148-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-150-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-152-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-154-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-156-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-158-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-160-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-162-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-164-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-166-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-168-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-170-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-172-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-174-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-176-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-178-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1676-179-0x0000000000400000-0x0000000000F88000-memory.dmpFilesize
11.5MB
-
memory/1676-180-0x0000000000400000-0x0000000000F88000-memory.dmpFilesize
11.5MB
-
memory/1676-181-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB