Overview
overview
8Static
static
8CCC/aspRwW...il.vbs
windows7-x64
1CCC/aspRwW...il.vbs
windows10-2004-x64
1CCC/aspSpy.vbs
windows7-x64
1CCC/aspSpy.vbs
windows10-2004-x64
1CCC/aspx.js
windows7-x64
1CCC/aspx.js
windows10-2004-x64
1CCC/phpSpy.js
windows7-x64
1CCC/phpSpy.js
windows10-2004-x64
1Customize/...ze.vbs
windows7-x64
1Customize/...ze.vbs
windows10-2004-x64
1caidao.exe
windows7-x64
8caidao.exe
windows10-2004-x64
8db.dll
windows7-x64
8db.dll
windows10-2004-x64
8readme.vbs
windows7-x64
1readme.vbs
windows10-2004-x64
1Analysis
-
max time kernel
40s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 18:46
Behavioral task
behavioral1
Sample
CCC/aspRwWithJMail.vbs
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
CCC/aspRwWithJMail.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
CCC/aspSpy.vbs
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
CCC/aspSpy.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
CCC/aspx.js
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
CCC/aspx.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
CCC/phpSpy.js
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
CCC/phpSpy.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
Customize/Customize.vbs
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Customize/Customize.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
caidao.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
caidao.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
db.dll
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
db.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
readme.vbs
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
readme.vbs
Resource
win10v2004-20221111-en
General
-
Target
db.dll
-
Size
101KB
-
MD5
bcda36d95b2500908993f446f174f0e4
-
SHA1
ea35726df90010fb86e86c57c6c9267304df759c
-
SHA256
ef17c3fe7f1dbd32436937f68a7b1a3ba0e8c3e85e0ae2441adc4b9bf09fc4e0
-
SHA512
446116a9261be0518b01450d35e9c66cd46f6d38f9552d45aaa34218aea1b70e17c2f11459a0b584fbf5956fffc0acebec6b9dcf06215660c2eefd9aba0e1478
-
SSDEEP
3072:9nJV8z7bcC52M0fHwYvp865IsgFmT9TP4j:zV8ncCkFfZp86+gC
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral13/memory/1720-57-0x00000000001F0000-0x0000000000223000-memory.dmp vmprotect -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 472 1720 WerFault.exe rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
rundll32.exepid process 1720 rundll32.exe 1720 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 948 wrote to memory of 1720 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 1720 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 1720 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 1720 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 1720 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 1720 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 1720 948 rundll32.exe rundll32.exe PID 1720 wrote to memory of 472 1720 rundll32.exe WerFault.exe PID 1720 wrote to memory of 472 1720 rundll32.exe WerFault.exe PID 1720 wrote to memory of 472 1720 rundll32.exe WerFault.exe PID 1720 wrote to memory of 472 1720 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db.dll,#12⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2363⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-60-0x0000000000000000-mapping.dmp
-
memory/1720-54-0x0000000000000000-mapping.dmp
-
memory/1720-55-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB
-
memory/1720-56-0x00000000001F1000-0x00000000001F5000-memory.dmpFilesize
16KB
-
memory/1720-57-0x00000000001F0000-0x0000000000223000-memory.dmpFilesize
204KB
-
memory/1720-61-0x00000000001F0000-0x0000000000223000-memory.dmpFilesize
204KB
-
memory/1720-62-0x00000000001F0000-0x0000000000223000-memory.dmpFilesize
204KB
-
memory/1720-63-0x00000000001F0000-0x0000000000223000-memory.dmpFilesize
204KB