Overview
overview
8Static
static
0909iocp�...ar.bat
windows7-x64
10909iocp�...ar.bat
windows10-2004-x64
10909iocp�...dow.js
windows7-x64
10909iocp�...dow.js
windows10-2004-x64
10909iocp�...dow.js
windows7-x64
10909iocp�...dow.js
windows10-2004-x64
1minilzo-2.02.vbs
windows7-x64
1minilzo-2.02.vbs
windows10-2004-x64
10909iocp�...Lib.js
windows7-x64
10909iocp�...Lib.js
windows10-2004-x64
10909iocp�...ay.exe
windows7-x64
10909iocp�...ay.exe
windows10-2004-x64
10909iocp�...s8.exe
windows7-x64
80909iocp�...s8.exe
windows10-2004-x64
80909iocp�...ock.js
windows7-x64
10909iocp�...ock.js
windows10-2004-x64
10909iocp�...ck2.js
windows7-x64
10909iocp�...ck2.js
windows10-2004-x64
10909iocp�...vfw.js
windows7-x64
10909iocp�...vfw.js
windows10-2004-x64
1加键盘�...ll.dll
windows7-x64
5加键盘�...ll.dll
windows10-2004-x64
5加键盘�...es.bat
windows7-x64
1加键盘�...es.bat
windows10-2004-x64
1加键盘�...ar.bat
windows7-x64
1加键盘�...ar.bat
windows10-2004-x64
1加键盘�...rv.exe
windows7-x64
3加键盘�...rv.exe
windows10-2004-x64
3加键盘�...ys.bat
windows7-x64
1加键盘�...ys.bat
windows10-2004-x64
1加键盘�...nit.js
windows7-x64
1加键盘�...nit.js
windows10-2004-x64
1Analysis
-
max time kernel
25s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 16:39
Static task
static1
Behavioral task
behavioral1
Sample
0909iocp控制端/clear.bat
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0909iocp控制端/clear.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
0909iocp控制端/主窗单元/MainWindow.js
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
0909iocp控制端/主窗单元/MainWindow.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
0909iocp控制端/主窗单元/MainWindow.js
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
0909iocp控制端/主窗单元/MainWindow.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
minilzo-2.02.vbs
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
minilzo-2.02.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
0909iocp控制端/压缩单元/zlib/XiaoNiuZLib.js
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
0909iocp控制端/压缩单元/zlib/XiaoNiuZLib.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
0909iocp控制端/播放器/Play.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
0909iocp控制端/播放器/Play.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
0909iocp控制端/服务单元/wmpcdcs8.exe
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
0909iocp控制端/服务单元/wmpcdcs8.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
0909iocp控制端/网络模块/mssock.js
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
0909iocp控制端/网络模块/mssock.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
0909iocp控制端/网络模块/winsock2/WinSock2.js
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
0909iocp控制端/网络模块/winsock2/WinSock2.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
0909iocp控制端/视频单元/vfw.js
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
0909iocp控制端/视频单元/vfw.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
加键盘记录dll/加键盘记录dll/VIPDll.dll
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
加键盘记录dll/加键盘记录dll/VIPDll.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
加键盘记录dll/加键盘记录dll/Window-create res/BuildRes.bat
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
加键盘记录dll/加键盘记录dll/Window-create res/BuildRes.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
加键盘记录dll/加键盘记录dll/clear.bat
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
加键盘记录dll/加键盘记录dll/clear.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
加键盘记录dll/加键盘记录dll/serv.exe
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
加键盘记录dll/加键盘记录dll/serv.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
加键盘记录dll/加键盘记录dll/sys.bat
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
加键盘记录dll/加键盘记录dll/sys.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
加键盘记录dll/加键盘记录dll/公用单元/PublicFunctionUnit.js
Resource
win7-20221111-en
Behavioral task
behavioral32
Sample
加键盘记录dll/加键盘记录dll/公用单元/PublicFunctionUnit.js
Resource
win10v2004-20221111-en
General
-
Target
0909iocp控制端/播放器/Play.exe
-
Size
397KB
-
MD5
4b22bade1e8520bf9bd0761dce3d2764
-
SHA1
237de3d72f89b62a4063e6368928e184052c5d8e
-
SHA256
bae32108ff418f222cc2f6f2ed924a4c9f309873b7cf71a986029af054c8481e
-
SHA512
9661c1f296ece04ee6004e6a57109940d70d1a06022d3aea7edd8e26eaca230e7b2e69a4baacb97513392c96c7f72b7386202aae83c669a1dc032f2608f19d5b
-
SSDEEP
6144:va98OISCZjsi5BIxGwB0Gbh9BSKVYv6uZF9AA9iD442CQUlzLyp5l:wIbZoizIxGM7UK2BT9AACQezLA
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 952 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 952 AUDIODG.EXE Token: 33 952 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 952 AUDIODG.EXE