Analysis
-
max time kernel
158s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
22/10/2023, 15:13
General
-
Target
美洽在线聊天.exe
-
Size
107.0MB
-
MD5
09d347a7bc1607ce40da64f8fa026416
-
SHA1
ee60594ea13b57181168849b39fa10074bd53019
-
SHA256
41764a72aea16530ba5e4ecc6c5af4d1bd723185823a5000d33154c7ace4faad
-
SHA512
ac06dcf79a69ab71c769d2d7e80bfadb5ad565da1f307a103af4df0aa1684babc04682a0ab4e5cb3c15434bb10f17f8eb60a9c1e892a6e39fe5f838a45fd565e
-
SSDEEP
3145728:qo31qNM5L5y+SiPXzQBtaf0WprGY+PDA:q9q58fiPXSRWpiYQA
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
VMProtect packed file 8 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\美洽在线聊天.exe"C:\Users\Admin\AppData\Local\Temp\美洽在线聊天.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\lytsts.exeC:\ProgramData\lytsts.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\Runn\Yloux.exe"C:\windows\Runn\Yloux.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\{B5E32792-1E65-4332-8C83-D7AC60FD6208}.exe"C:\Users\Admin\AppData\Local\Temp\{B5E32792-1E65-4332-8C83-D7AC60FD6208}.exe" /s "C:\Users\Admin\AppData\Local\Temp\\{DC10E3C9-E4EA-44ed-8BC6-7CAA426044BE}"1⤵
- Executes dropped EXE
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD591629d01d51365c021b4a8eb8e02c79c
SHA18415ae7359c0ff94c32760a55fd9907b160ec986
SHA2568b95ffcaa2f6ade3a3cf6034d216a24c974afd273022410d3b3436d69f0cef78
SHA512257a748c72d3fc3b1270752f2b900cfa4654e49fb20b984b425439bef58de1ecb3b8db89dd1a4d3c0c285cf041c0024b7f34c518fbefe83c108f498cc4e59bd9
-
Filesize
5.7MB
MD591629d01d51365c021b4a8eb8e02c79c
SHA18415ae7359c0ff94c32760a55fd9907b160ec986
SHA2568b95ffcaa2f6ade3a3cf6034d216a24c974afd273022410d3b3436d69f0cef78
SHA512257a748c72d3fc3b1270752f2b900cfa4654e49fb20b984b425439bef58de1ecb3b8db89dd1a4d3c0c285cf041c0024b7f34c518fbefe83c108f498cc4e59bd9
-
Filesize
2KB
MD5ff0c7c2667dff4f3ed588f40d047c642
SHA11162c83bd0bb0d81b7ab7f616cb012b790aa4adf
SHA25602af5cb061fd8075e9475c45ab20e86cf2bb4ca9511ddad348645ed5183b9fc7
SHA512539b1d443232758b6c60a287f2a40200e6e3ba7353f11f18e29ba265c9569a4610e4a80910f79660368a916576ab9c486efa248bf3257e522ef5bfb3d42ef3c3
-
Filesize
1.0MB
MD5217dc98e219a340cb09915244c992a52
SHA1a04f101ca7180955d62e4a1aaeccdcca489209da
SHA25627c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
-
Filesize
215B
MD559eff0d5634b9af7035a2ca388f03476
SHA1c15056b4bdf594de2f8fd7bb9eb51e424adff7bc
SHA2565d5dd476beb63411d00d84c091fd0ca16118f0c0cd27c80b8085f4f907ca2124
SHA512cb8d6e18d2a026856759f6518d48d859d59c7db962bace7d874f53a4af307e7c652e3a27b64bff9f57891f1bab9e1c98811f6f1d4c795796103798e1971435f2
-
Filesize
3.1MB
MD5e2afee96ff3cbc1b5b35a38186d8b39e
SHA13564bf9a4d2a4740a8abf4532cacf403f6a66137
SHA2565d88486be7c9e3725b44f83a6ff7dd34fd904a7c1150f681536a2b0bad763a87
SHA512ba22ada42bc1c76c032ae91ebbd76ef246a33222c5673ee7b7dcfd87ac1cf2b17ad65a1218742dc16d2035fe3397e1d92ff20a2c2dc7e097b35b08eafa898b2f
-
Filesize
378KB
MD51cf48ca2ae8f8113c5f6028dd42855ad
SHA1084d7b4693ac808bec8832bbde2b79140ff3b54e
SHA256748e26fecae889826be5e1f8c2fe2b0bc5a13f5f2c89568416422b6d2c6c7c9e
SHA5126a125bef297f630e6a10ccf79bff0a3199204f21e98e9c01ea2c6fc44378e7ea7a36d2d894c185c1c6c0c94db9755bc69a7289ae75b682d57ff2143d799fb949
-
Filesize
3.1MB
MD5e2afee96ff3cbc1b5b35a38186d8b39e
SHA13564bf9a4d2a4740a8abf4532cacf403f6a66137
SHA2565d88486be7c9e3725b44f83a6ff7dd34fd904a7c1150f681536a2b0bad763a87
SHA512ba22ada42bc1c76c032ae91ebbd76ef246a33222c5673ee7b7dcfd87ac1cf2b17ad65a1218742dc16d2035fe3397e1d92ff20a2c2dc7e097b35b08eafa898b2f
-
Filesize
5.7MB
MD591629d01d51365c021b4a8eb8e02c79c
SHA18415ae7359c0ff94c32760a55fd9907b160ec986
SHA2568b95ffcaa2f6ade3a3cf6034d216a24c974afd273022410d3b3436d69f0cef78
SHA512257a748c72d3fc3b1270752f2b900cfa4654e49fb20b984b425439bef58de1ecb3b8db89dd1a4d3c0c285cf041c0024b7f34c518fbefe83c108f498cc4e59bd9
-
Filesize
1.0MB
MD5217dc98e219a340cb09915244c992a52
SHA1a04f101ca7180955d62e4a1aaeccdcca489209da
SHA25627c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
-
Filesize
3.1MB
MD5e2afee96ff3cbc1b5b35a38186d8b39e
SHA13564bf9a4d2a4740a8abf4532cacf403f6a66137
SHA2565d88486be7c9e3725b44f83a6ff7dd34fd904a7c1150f681536a2b0bad763a87
SHA512ba22ada42bc1c76c032ae91ebbd76ef246a33222c5673ee7b7dcfd87ac1cf2b17ad65a1218742dc16d2035fe3397e1d92ff20a2c2dc7e097b35b08eafa898b2f
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
380KB
-
Filesize
9.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
9.2MB
-
Filesize
9.2MB
-
Filesize
4KB
-
Filesize
9.2MB
-
Filesize
4KB
-
Filesize
4KB