333b6a1847b3e7f828ff6872f3509d456e4c3b8e064a7c8ba255bd2005a582b1

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2023, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

智阳风控端安装程序.exe
Size

22.6MB
MD5

629ca404826bc6592bb2efdbf9391309
SHA1

be036f74b9eb9ad7e7d33815c2dfbb279ae91916
SHA256

333b6a1847b3e7f828ff6872f3509d456e4c3b8e064a7c8ba255bd2005a582b1
SHA512

aef8c4595f28f164e2215b4d31322ad94231fa04c7ac5a7ce85ca196a01c008ba045a1b019bbb92aac840cf514411368137c64fbd44b6ca09bc3e37b2b37a28d
SSDEEP

393216:N7MN/df27rbstLX0l1YSIs2H32SO3CPATY5t/yWV7AJBgUFa/2t/oWexNEBcP5+b:N7k/d+nbstLX0lySITmSO3IATctKWwgs

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1996	智阳风控端安装程序.exe
1996	智阳风控端安装程序.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\智阳风控端安装程序.exe
"C:\Users\Admin\AppData\Local\Temp\智阳风控端安装程序.exe"
1⤵
- Loads dropped DLL
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu87D3.tmp\InstallOptions.dll

Filesize
15KB

MD5
67f2ef30bc54036cf3164e76219e5864

SHA1
bf0586855ac7427b35d08909dba6a6a8d2c22e92

SHA256
c55b1140b6e5b9ed5dec99d3b10458e2966f9701895931642a8fe0c260d7f880

SHA512
1a944462453435e88c7fb4ac8beaa8ea8febbbadd83faf8549f95a3046636b3543c4e8dbed14872a1d42793b6496b797fffc7300bbce62ab0d650017ef26e98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu87D3.tmp\InstallOptions.dll

Filesize
15KB

MD5
67f2ef30bc54036cf3164e76219e5864

SHA1
bf0586855ac7427b35d08909dba6a6a8d2c22e92

SHA256
c55b1140b6e5b9ed5dec99d3b10458e2966f9701895931642a8fe0c260d7f880

SHA512
1a944462453435e88c7fb4ac8beaa8ea8febbbadd83faf8549f95a3046636b3543c4e8dbed14872a1d42793b6496b797fffc7300bbce62ab0d650017ef26e98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu87D3.tmp\InstallOptions.dll

Filesize
15KB

MD5
67f2ef30bc54036cf3164e76219e5864

SHA1
bf0586855ac7427b35d08909dba6a6a8d2c22e92

SHA256
c55b1140b6e5b9ed5dec99d3b10458e2966f9701895931642a8fe0c260d7f880

SHA512
1a944462453435e88c7fb4ac8beaa8ea8febbbadd83faf8549f95a3046636b3543c4e8dbed14872a1d42793b6496b797fffc7300bbce62ab0d650017ef26e98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu87D3.tmp\ioSpecial.ini

Filesize
1KB

MD5
fea90a9c52b81b7b1564b1fed01655e9

SHA1
6db62b5be00f7ccb53df476e1d852414ff2534e3

SHA256
1aab02165ecf11310f86994c18a7ca475ac09669cf6840a4c6d15f9eae9d5241

SHA512
3fe3b2b369218438492460398b6b9f51c53f649cb4a1940467e9ff58203c2acb078a5b9d99b5c977c0fc55574d22f379d0e21a77049a11d74eed0047e1ff2c76

Download Submit