Analysis
-
max time kernel
152s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
22/10/2023, 15:13
General
-
Target
美洽在线聊天.exe
-
Size
107.0MB
-
MD5
09d347a7bc1607ce40da64f8fa026416
-
SHA1
ee60594ea13b57181168849b39fa10074bd53019
-
SHA256
41764a72aea16530ba5e4ecc6c5af4d1bd723185823a5000d33154c7ace4faad
-
SHA512
ac06dcf79a69ab71c769d2d7e80bfadb5ad565da1f307a103af4df0aa1684babc04682a0ab4e5cb3c15434bb10f17f8eb60a9c1e892a6e39fe5f838a45fd565e
-
SSDEEP
3145728:qo31qNM5L5y+SiPXzQBtaf0WprGY+PDA:q9q58fiPXSRWpiYQA
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
VMProtect packed file 7 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\美洽在线聊天.exe"C:\Users\Admin\AppData\Local\Temp\美洽在线聊天.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\lytsts.exeC:\ProgramData\lytsts.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\Runn\Yloux.exe"C:\windows\Runn\Yloux.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\{9195DF8E-A2F0-4cdc-B7D1-E7D92FB1C54C}.exe"C:\Users\Admin\AppData\Local\Temp\{9195DF8E-A2F0-4cdc-B7D1-E7D92FB1C54C}.exe" /s "C:\Users\Admin\AppData\Local\Temp\\{3001C810-9730-4484-A5AD-D8919A2F1FF6}"1⤵
- Executes dropped EXE
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD591629d01d51365c021b4a8eb8e02c79c
SHA18415ae7359c0ff94c32760a55fd9907b160ec986
SHA2568b95ffcaa2f6ade3a3cf6034d216a24c974afd273022410d3b3436d69f0cef78
SHA512257a748c72d3fc3b1270752f2b900cfa4654e49fb20b984b425439bef58de1ecb3b8db89dd1a4d3c0c285cf041c0024b7f34c518fbefe83c108f498cc4e59bd9
-
Filesize
5.7MB
MD591629d01d51365c021b4a8eb8e02c79c
SHA18415ae7359c0ff94c32760a55fd9907b160ec986
SHA2568b95ffcaa2f6ade3a3cf6034d216a24c974afd273022410d3b3436d69f0cef78
SHA512257a748c72d3fc3b1270752f2b900cfa4654e49fb20b984b425439bef58de1ecb3b8db89dd1a4d3c0c285cf041c0024b7f34c518fbefe83c108f498cc4e59bd9
-
Filesize
1KB
MD53c2caaa6db392effb0bf6acb7f981f56
SHA196b6402bc71c46ccfa802f30b30043f59f82f4ab
SHA2566acd03da0ed353d82c29dccbb6a171bef871d2243afcaef36df4845e90dc10f8
SHA512bb238b11a833dbccb7ecc7fe410d13ca6f9ab25e6a7a147df6a1efccf5ff200aa0fc652864facc3c7efc7f07febf2f09d4df8368025110b6b2a618a8cf1fca49
-
Filesize
862B
MD56867ce99d3a28431a063a78b32736a5a
SHA16fdeacc20a585a1925888ae9d435b5e86db12747
SHA256444312c32242308ca1571a230ac09a940a14ad2facb81577bed2b14ed235eb9e
SHA512b7415356c75709aebe36922fcbe003f2821fee9dd80a8ae02f6ffa5068a02fd3aee3e74612f0e4d46eeda31c5a210114369e5ee6b24e1e0eb1941249dfa83af5
-
Filesize
215B
MD5389c9921c042440fcc67af97f1ff56f5
SHA133c62bc66ef9900a547adae1a3db58fe6e3bf65f
SHA2567c61ce7227ebdaf68f5b0d29639fa123fae77b18342feb198658042c99445bc6
SHA5129a221d5a014b01ad29f9ee5d08db284ac36b1caa48a4edf94a938c8ebbd4036c120be695f07f1b3fbba7241789f0499ab82f6b936d37f0f6539edd0b94300205
-
Filesize
1.0MB
MD5217dc98e219a340cb09915244c992a52
SHA1a04f101ca7180955d62e4a1aaeccdcca489209da
SHA25627c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
-
Filesize
1.0MB
MD5217dc98e219a340cb09915244c992a52
SHA1a04f101ca7180955d62e4a1aaeccdcca489209da
SHA25627c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
-
Filesize
3.1MB
MD5e2afee96ff3cbc1b5b35a38186d8b39e
SHA13564bf9a4d2a4740a8abf4532cacf403f6a66137
SHA2565d88486be7c9e3725b44f83a6ff7dd34fd904a7c1150f681536a2b0bad763a87
SHA512ba22ada42bc1c76c032ae91ebbd76ef246a33222c5673ee7b7dcfd87ac1cf2b17ad65a1218742dc16d2035fe3397e1d92ff20a2c2dc7e097b35b08eafa898b2f
-
Filesize
3.1MB
MD5e2afee96ff3cbc1b5b35a38186d8b39e
SHA13564bf9a4d2a4740a8abf4532cacf403f6a66137
SHA2565d88486be7c9e3725b44f83a6ff7dd34fd904a7c1150f681536a2b0bad763a87
SHA512ba22ada42bc1c76c032ae91ebbd76ef246a33222c5673ee7b7dcfd87ac1cf2b17ad65a1218742dc16d2035fe3397e1d92ff20a2c2dc7e097b35b08eafa898b2f
-
Filesize
378KB
MD51cf48ca2ae8f8113c5f6028dd42855ad
SHA1084d7b4693ac808bec8832bbde2b79140ff3b54e
SHA256748e26fecae889826be5e1f8c2fe2b0bc5a13f5f2c89568416422b6d2c6c7c9e
SHA5126a125bef297f630e6a10ccf79bff0a3199204f21e98e9c01ea2c6fc44378e7ea7a36d2d894c185c1c6c0c94db9755bc69a7289ae75b682d57ff2143d799fb949
-
Filesize
3.1MB
MD5e2afee96ff3cbc1b5b35a38186d8b39e
SHA13564bf9a4d2a4740a8abf4532cacf403f6a66137
SHA2565d88486be7c9e3725b44f83a6ff7dd34fd904a7c1150f681536a2b0bad763a87
SHA512ba22ada42bc1c76c032ae91ebbd76ef246a33222c5673ee7b7dcfd87ac1cf2b17ad65a1218742dc16d2035fe3397e1d92ff20a2c2dc7e097b35b08eafa898b2f
-
Filesize
4KB
-
Filesize
9.2MB
-
Filesize
9.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.2MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
9.2MB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.0MB