Overview
overview
7Static
static
7Новая...dr.mbn
windows10-1703-x64
6Новая...dm.sys
windows10-1703-x64
1Новая...ev.sys
windows10-1703-x64
1Новая...om.sys
windows10-1703-x64
1Новая...al.sys
windows10-1703-x64
1Новая...er.sys
windows10-1703-x64
1Новая...r2.dll
windows10-1703-x64
1Новая...09.dll
windows10-1703-x64
1Новая...rv.sys
windows10-1703-x64
1Новая...er.sys
windows10-1703-x64
1Новая...ev.sys
windows10-1703-x64
1Новая...dm.sys
windows10-1703-x64
1Новая...ev.sys
windows10-1703-x64
1Новая...om.sys
windows10-1703-x64
1Новая...al.sys
windows10-1703-x64
1Новая...er.sys
windows10-1703-x64
1Новая...r2.dll
windows10-1703-x64
3Новая...ll.exe
windows10-1703-x64
1Новая...�.docx
windows10-1703-x64
1Новая...ce.dll
windows10-1703-x64
1Новая...rt.doc
windows10-1703-x64
1Новая...db.exe
windows10-1703-x64
1Новая...dr.mbn
windows10-1703-x64
3Новая...dr.mbn
windows10-1703-x64
3Новая...dr.mbn
windows10-1703-x64
3Новая...dr.mbn
windows10-1703-x64
3Новая...en.exe
windows10-1703-x64
7Новая...dr.mbn
windows10-1703-x64
3Новая...dr.mbn
windows10-1703-x64
3Новая...dr.elf
windows10-1703-x64
3Новая...dr.elf
windows10-1703-x64
3Новая...dr.elf
windows10-1703-x64
3Analysis
-
max time kernel
309s -
max time network
1592s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
23/12/2023, 08:11
Behavioral task
behavioral1
Sample
Новая папка/2.60/date/3_emmc_ddr.mbn
Resource
win10-20231215-en
Behavioral task
behavioral2
Sample
Новая папка/2.60/date/android/Driver/X64/hw_quusbmdm.sys
Resource
win10-20231215-en
Behavioral task
behavioral3
Sample
Новая папка/2.60/date/android/Driver/X64/hw_usbdev.sys
Resource
win10-20231215-en
Behavioral task
behavioral4
Sample
Новая папка/2.60/date/android/Driver/X64/hw_usbvcom.sys
Resource
win10-20231215-en
Behavioral task
behavioral5
Sample
Новая папка/2.60/date/android/Driver/X64/qu_usb_serial.sys
Resource
win10-20231215-en
Behavioral task
behavioral6
Sample
Новая папка/2.60/date/android/Driver/X64/usbser.sys
Resource
win10-20231215-en
Behavioral task
behavioral7
Sample
Новая папка/2.60/date/android/Driver/X64/winusbcoinstaller2.dll
Resource
win10-20231215-en
Behavioral task
behavioral8
Sample
Новая папка/2.60/date/android/Driver/X86/WdfCoInstaller01009.dll
Resource
win10-20231215-en
Behavioral task
behavioral9
Sample
Новая папка/2.60/date/android/Driver/X86/diagswitchdrv.sys
Resource
win10-20231215-en
Behavioral task
behavioral10
Sample
Новая папка/2.60/date/android/Driver/X86/ew_usbccgpfilter.sys
Resource
win10-20231215-en
Behavioral task
behavioral11
Sample
Новая папка/2.60/date/android/Driver/X86/hw_ctrlfakedev.sys
Resource
win10-20231215-en
Behavioral task
behavioral12
Sample
Новая папка/2.60/date/android/Driver/X86/hw_quusbmdm.sys
Resource
win10-20231215-en
Behavioral task
behavioral13
Sample
Новая папка/2.60/date/android/Driver/X86/hw_usbdev.sys
Resource
win10-20231215-en
Behavioral task
behavioral14
Sample
Новая папка/2.60/date/android/Driver/X86/hw_usbvcom.sys
Resource
win10-20231215-en
Behavioral task
behavioral15
Sample
Новая папка/2.60/date/android/Driver/X86/qu_usb_serial.sys
Resource
win10-20231215-en
Behavioral task
behavioral16
Sample
Новая папка/2.60/date/android/Driver/X86/usbser.sys
Resource
win10-20231215-en
Behavioral task
behavioral17
Sample
Новая папка/2.60/date/android/Driver/X86/winusbcoinstaller2.dll
Resource
win10-20231215-en
Behavioral task
behavioral18
Sample
Новая папка/2.60/date/android/DriverUninstall.exe
Resource
win10-20231215-en
Behavioral task
behavioral19
Sample
Новая папка/2.60/date/android/HandSet ProductLine 2.01.02.00版本配套表.docx
Resource
win10-20231215-en
Behavioral task
behavioral20
Sample
Новая папка/2.60/date/android/LocateDevice.dll
Resource
win10-20231215-en
Behavioral task
behavioral21
Sample
Новая папка/2.60/date/android/USB-Driver C00B101 Virus Scan Report.doc
Resource
win10-20231215-en
Behavioral task
behavioral22
Sample
Новая папка/2.60/date/android/adb.exe
Resource
win10-20231215-en
Behavioral task
behavioral23
Sample
Новая папка/2.60/date/hm4_gp_emmc_ddr.mbn
Resource
win10-20231215-en
Behavioral task
behavioral24
Sample
Новая папка/2.60/date/hm4_pt_emmc_ddr.mbn
Resource
win10-20231215-en
Behavioral task
behavioral25
Sample
Новая папка/2.60/date/hm4a_emmc_ddr.mbn
Resource
win10-20231215-en
Behavioral task
behavioral26
Sample
Новая папка/2.60/date/hm_note3_emmc_ddr.mbn
Resource
win10-20231215-en
Behavioral task
behavioral27
Sample
Новая папка/2.60/date/hw_tool_en.exe
Resource
win10-20231215-en
Behavioral task
behavioral28
Sample
Новая папка/2.60/date/max_gp_emmc_ddr.mbn
Resource
win10-20231215-en
Behavioral task
behavioral29
Sample
Новая папка/2.60/date/max_pt_emmc_ddr.mbn
Resource
win10-20231215-en
Behavioral task
behavioral30
Sample
Новая папка/2.60/date/mi5_ufs_ddr.elf
Resource
win10-20231215-en
Behavioral task
behavioral31
Sample
Новая папка/2.60/date/mi5s_ufs_ddr.elf
Resource
win10-20231215-en
Behavioral task
behavioral32
Sample
Новая папка/2.60/date/mix_ufs_ddr.elf
Resource
win10-20231215-en
General
-
Target
Новая папка/2.60/date/android/Driver/X86/winusbcoinstaller2.dll
-
Size
831KB
-
MD5
8e7b9f81e8823fee2d82f7de3a44300b
-
SHA1
1633b3715014c90d1c552cd757ef5de33c161dee
-
SHA256
ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c
-
SHA512
9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9
-
SSDEEP
12288:cZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQlT:cZwoP7MYG+pX501zBoC+wtxuPXrmQlT
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process 2372 2592 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 308 wrote to memory of 2592 308 rundll32.exe 16 PID 308 wrote to memory of 2592 308 rundll32.exe 16 PID 308 wrote to memory of 2592 308 rundll32.exe 16
Processes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 6161⤵
- Program crash
PID:2372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Новая папка\2.60\date\android\Driver\X86\winusbcoinstaller2.dll",#11⤵PID:2592
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Новая папка\2.60\date\android\Driver\X86\winusbcoinstaller2.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:308