Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
-
submitted
25/08/2023, 04:16
General
-
Target
被控端.exe
-
Size
1.3MB
-
MD5
a81c0bc1b3dcd4a5386f81c3f013afc0
-
SHA1
a2e0553d84f25859d3509d64ed58809a68104052
-
SHA256
9fa13f87b3b7154c68c36fc9ec5cd3dec4c5ee2a7d78f06edd93539b1ac27aed
-
SHA512
723de3db4cbaa416c7feea215f44064a2ce2f6e0d87e738afa5847a1ee172736328efd11e6d1e4b9ab33dc89c350f279142f0eb758ae260ee872390b65826f5f
-
SSDEEP
24576:OXpQs62u6fGL0Jr8Ub09JskxRyEgSI84VxOFRbfDmorQf5lOBzLaTATPLo824WgB:OZz6ofGm8UA9JskxRyjSI84VxuRbfLrm
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\被控端.exe"C:\Users\Admin\AppData\Local\Temp\被控端.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inc\DBremotes.exeC:\Users\Admin\AppData\Local\Temp\inc\DBremotes.exe -setservicevncpass 0e74f08 -setservicereadpass 0e74f09 -setservicerfbport 49218 -setserviceremovedeskwall 1 -setservicetrayicon 0 -setapp2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\inc\DBremotes.exe"C:\Users\Admin\AppData\Local\Temp\inc\DBremotes.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inc\DBremotes.exe"C:\Users\Admin\AppData\Local\Temp\inc\DBremotes.exe" -controlapp -slave3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
637B
MD5a11227b32821325eb9f417df9c91ea64
SHA1ee5bf38fe06e87fcaa6d0c094fbfea60fb6a63c2
SHA256776a45cfbd5c9a8f5f76940c39a8df3a22461001f930390695b3cc7e6bb8633f
SHA512773ec3859aa23f34f59f8e90d78ab148342a1bdecdf8f055768c25c8f5a31d58a06745750a87d1ef0ac440789bac5e5616a0fd82ddcee027a661058b37bbf02e
-
Filesize
1.8MB
MD521097291ae55dc2565a4c0362348b7f1
SHA1ae371de55ea330d2beadaafbd3353ef0aa7c696c
SHA256dda179f332180866998386fe447656e1432187c989e970fc19d41d30be70adeb
SHA512718fab5e6c1ac0e0ed82c31143442426346c6a5a0527d527f03ddc11e60d0445a33c287691fe2170e69ecfd914ffa28b0c9622c397e37e25c0370efe52906fb3
-
Filesize
1.8MB
MD521097291ae55dc2565a4c0362348b7f1
SHA1ae371de55ea330d2beadaafbd3353ef0aa7c696c
SHA256dda179f332180866998386fe447656e1432187c989e970fc19d41d30be70adeb
SHA512718fab5e6c1ac0e0ed82c31143442426346c6a5a0527d527f03ddc11e60d0445a33c287691fe2170e69ecfd914ffa28b0c9622c397e37e25c0370efe52906fb3
-
Filesize
1.8MB
MD521097291ae55dc2565a4c0362348b7f1
SHA1ae371de55ea330d2beadaafbd3353ef0aa7c696c
SHA256dda179f332180866998386fe447656e1432187c989e970fc19d41d30be70adeb
SHA512718fab5e6c1ac0e0ed82c31143442426346c6a5a0527d527f03ddc11e60d0445a33c287691fe2170e69ecfd914ffa28b0c9622c397e37e25c0370efe52906fb3
-
Filesize
1.8MB
MD521097291ae55dc2565a4c0362348b7f1
SHA1ae371de55ea330d2beadaafbd3353ef0aa7c696c
SHA256dda179f332180866998386fe447656e1432187c989e970fc19d41d30be70adeb
SHA512718fab5e6c1ac0e0ed82c31143442426346c6a5a0527d527f03ddc11e60d0445a33c287691fe2170e69ecfd914ffa28b0c9622c397e37e25c0370efe52906fb3
-
Filesize
1.8MB
MD521097291ae55dc2565a4c0362348b7f1
SHA1ae371de55ea330d2beadaafbd3353ef0aa7c696c
SHA256dda179f332180866998386fe447656e1432187c989e970fc19d41d30be70adeb
SHA512718fab5e6c1ac0e0ed82c31143442426346c6a5a0527d527f03ddc11e60d0445a33c287691fe2170e69ecfd914ffa28b0c9622c397e37e25c0370efe52906fb3
-
Filesize
191KB
MD5c0755ec60b32bf59fb13758f958106e6
SHA173f0038c811b635a877d2e96069a9fc781c36115
SHA256c3e7c4f23fbe61f17be9608b7be78094c19ec33b200c94e3666f14f2fe38483b
SHA5125cf36feadbe72cbe536f8174b74c5755cfa72d5e727e9df264d558f5f40b0dad7f7c875786fc14fcdcdfa72836800639249f2ffc6fd548ed54f9327000524fdf
-
Filesize
1.8MB
MD521097291ae55dc2565a4c0362348b7f1
SHA1ae371de55ea330d2beadaafbd3353ef0aa7c696c
SHA256dda179f332180866998386fe447656e1432187c989e970fc19d41d30be70adeb
SHA512718fab5e6c1ac0e0ed82c31143442426346c6a5a0527d527f03ddc11e60d0445a33c287691fe2170e69ecfd914ffa28b0c9622c397e37e25c0370efe52906fb3
-
Filesize
1.8MB
MD521097291ae55dc2565a4c0362348b7f1
SHA1ae371de55ea330d2beadaafbd3353ef0aa7c696c
SHA256dda179f332180866998386fe447656e1432187c989e970fc19d41d30be70adeb
SHA512718fab5e6c1ac0e0ed82c31143442426346c6a5a0527d527f03ddc11e60d0445a33c287691fe2170e69ecfd914ffa28b0c9622c397e37e25c0370efe52906fb3
-
Filesize
1.8MB
MD521097291ae55dc2565a4c0362348b7f1
SHA1ae371de55ea330d2beadaafbd3353ef0aa7c696c
SHA256dda179f332180866998386fe447656e1432187c989e970fc19d41d30be70adeb
SHA512718fab5e6c1ac0e0ed82c31143442426346c6a5a0527d527f03ddc11e60d0445a33c287691fe2170e69ecfd914ffa28b0c9622c397e37e25c0370efe52906fb3
-
Filesize
172KB
MD5446c0a7734db91342b8b10e57f3a6b09
SHA11c2e26eb886243b12fa7a4c9a8712d2d877b3751
SHA25629f83514c7028c7de0fb07aeb4ed8120b460e757880634d675e6fde1386d76f1
SHA51256acfdd0c24adc8e132eeab17159815fcf60e2e84016e1b2d2bfcf19c901165ea180bb5a143051cfcc6fd90e252a21efa01e1e028099a7b0fcb4c34f0dd204ff
-
Filesize
191KB
MD5c0755ec60b32bf59fb13758f958106e6
SHA173f0038c811b635a877d2e96069a9fc781c36115
SHA256c3e7c4f23fbe61f17be9608b7be78094c19ec33b200c94e3666f14f2fe38483b
SHA5125cf36feadbe72cbe536f8174b74c5755cfa72d5e727e9df264d558f5f40b0dad7f7c875786fc14fcdcdfa72836800639249f2ffc6fd548ed54f9327000524fdf
-
Filesize
191KB
MD5c0755ec60b32bf59fb13758f958106e6
SHA173f0038c811b635a877d2e96069a9fc781c36115
SHA256c3e7c4f23fbe61f17be9608b7be78094c19ec33b200c94e3666f14f2fe38483b
SHA5125cf36feadbe72cbe536f8174b74c5755cfa72d5e727e9df264d558f5f40b0dad7f7c875786fc14fcdcdfa72836800639249f2ffc6fd548ed54f9327000524fdf
-
Filesize
191KB
MD5c0755ec60b32bf59fb13758f958106e6
SHA173f0038c811b635a877d2e96069a9fc781c36115
SHA256c3e7c4f23fbe61f17be9608b7be78094c19ec33b200c94e3666f14f2fe38483b
SHA5125cf36feadbe72cbe536f8174b74c5755cfa72d5e727e9df264d558f5f40b0dad7f7c875786fc14fcdcdfa72836800639249f2ffc6fd548ed54f9327000524fdf
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB