Overview
overview
3Static
static
3啊哈C/SciLexer.dll
windows7-x64
3啊哈C/SciLexer.dll
windows10-2004-x64
1啊哈C/aha-c.exe
windows7-x64
1啊哈C/aha-c.exe
windows10-2004-x64
1啊哈C/co...=m.exe
windows7-x64
1啊哈C/co...=m.exe
windows10-2004-x64
1啊哈C/co...ne.exe
windows7-x64
1啊哈C/co...ne.exe
windows10-2004-x64
1啊哈C/co...ar.exe
windows7-x64
1啊哈C/co...ar.exe
windows10-2004-x64
1啊哈C/co...as.exe
windows7-x64
1啊哈C/co...as.exe
windows10-2004-x64
1啊哈C/co...++.exe
windows7-x64
1啊哈C/co...++.exe
windows10-2004-x64
1啊哈C/co...lt.exe
windows7-x64
1啊哈C/co...lt.exe
windows10-2004-x64
1啊哈C/co...pp.exe
windows7-x64
1啊哈C/co...pp.exe
windows10-2004-x64
1啊哈C/co...ol.exe
windows7-x64
1啊哈C/co...ol.exe
windows10-2004-x64
1啊哈C/co...ap.exe
windows7-x64
1啊哈C/co...ap.exe
windows10-2004-x64
1啊哈C/co...++.exe
windows7-x64
1啊哈C/co...++.exe
windows10-2004-x64
1啊哈C/co...cc.exe
windows7-x64
1啊哈C/co...cc.exe
windows10-2004-x64
1啊哈C/co...gccbug
ubuntu-18.04-amd64
3啊哈C/co...gccbug
debian-9-armhf
1啊哈C/co...gccbug
debian-9-mips
1啊哈C/co...gccbug
debian-9-mipsel
1啊哈C/co...ov.exe
windows7-x64
1啊哈C/co...ov.exe
windows10-2004-x64
1Analysis
-
max time kernel
19s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 04:58
Static task
static1
Behavioral task
behavioral1
Sample
啊哈C/SciLexer.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
啊哈C/SciLexer.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
啊哈C/aha-c.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
啊哈C/aha-c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
啊哈C/core/bin/--library=m.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
啊哈C/core/bin/--library=m.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
啊哈C/core/bin/addr2line.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
啊哈C/core/bin/addr2line.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
啊哈C/core/bin/ar.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
啊哈C/core/bin/ar.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
啊哈C/core/bin/as.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
啊哈C/core/bin/as.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
啊哈C/core/bin/c++.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
啊哈C/core/bin/c++.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
啊哈C/core/bin/c++filt.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
啊哈C/core/bin/c++filt.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
啊哈C/core/bin/cpp.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
啊哈C/core/bin/cpp.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
啊哈C/core/bin/dlltool.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
啊哈C/core/bin/dlltool.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
啊哈C/core/bin/dllwrap.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
啊哈C/core/bin/dllwrap.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
啊哈C/core/bin/g++.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
啊哈C/core/bin/g++.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
啊哈C/core/bin/gcc.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
啊哈C/core/bin/gcc.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
啊哈C/core/bin/gccbug
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral28
Sample
啊哈C/core/bin/gccbug
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral29
Sample
啊哈C/core/bin/gccbug
Resource
debian9-mipsbe-20231222-en
Behavioral task
behavioral30
Sample
啊哈C/core/bin/gccbug
Resource
debian9-mipsel-20231222-en
Behavioral task
behavioral31
Sample
啊哈C/core/bin/gcov.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
啊哈C/core/bin/gcov.exe
Resource
win10v2004-20231215-en
General
-
Target
啊哈C/core/bin/--library=m.exe
-
Size
16KB
-
MD5
f93784f1055cd1d04b312e45ab9072a6
-
SHA1
6a2249157f6592704fd2095af4c3c9146b8e5401
-
SHA256
bf772c64a2a4ab415f52ae696bea0aacb1a94d125a59b4361287cd28c10dc805
-
SHA512
5c3ed6da41fab9ddff9cf5032de911541fd4681f8fc06db37c60f2e8a1d0b6ae6819e5010077e43f67cabd859af7a4ae55286a5eb1a0739d8f53c987bbe2dd47
-
SSDEEP
192:R/aHhiBQsGF3+qmuYO3ck4/kjyFSrncCD5:RkFuqmj+ck4MeMrnr9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2924 3040 --library=m.exe 14 PID 3040 wrote to memory of 2924 3040 --library=m.exe 14 PID 3040 wrote to memory of 2924 3040 --library=m.exe 14 PID 3040 wrote to memory of 2924 3040 --library=m.exe 14 PID 3040 wrote to memory of 1912 3040 --library=m.exe 30 PID 3040 wrote to memory of 1912 3040 --library=m.exe 30 PID 3040 wrote to memory of 1912 3040 --library=m.exe 30 PID 3040 wrote to memory of 1912 3040 --library=m.exe 30 PID 3040 wrote to memory of 2696 3040 --library=m.exe 31 PID 3040 wrote to memory of 2696 3040 --library=m.exe 31 PID 3040 wrote to memory of 2696 3040 --library=m.exe 31 PID 3040 wrote to memory of 2696 3040 --library=m.exe 31 PID 3040 wrote to memory of 2752 3040 --library=m.exe 32 PID 3040 wrote to memory of 2752 3040 --library=m.exe 32 PID 3040 wrote to memory of 2752 3040 --library=m.exe 32 PID 3040 wrote to memory of 2752 3040 --library=m.exe 32 PID 3040 wrote to memory of 2768 3040 --library=m.exe 33 PID 3040 wrote to memory of 2768 3040 --library=m.exe 33 PID 3040 wrote to memory of 2768 3040 --library=m.exe 33 PID 3040 wrote to memory of 2768 3040 --library=m.exe 33 PID 3040 wrote to memory of 2784 3040 --library=m.exe 34 PID 3040 wrote to memory of 2784 3040 --library=m.exe 34 PID 3040 wrote to memory of 2784 3040 --library=m.exe 34 PID 3040 wrote to memory of 2784 3040 --library=m.exe 34 PID 3040 wrote to memory of 2816 3040 --library=m.exe 35 PID 3040 wrote to memory of 2816 3040 --library=m.exe 35 PID 3040 wrote to memory of 2816 3040 --library=m.exe 35 PID 3040 wrote to memory of 2816 3040 --library=m.exe 35 PID 3040 wrote to memory of 2720 3040 --library=m.exe 36 PID 3040 wrote to memory of 2720 3040 --library=m.exe 36 PID 3040 wrote to memory of 2720 3040 --library=m.exe 36 PID 3040 wrote to memory of 2720 3040 --library=m.exe 36 PID 3040 wrote to memory of 2716 3040 --library=m.exe 37 PID 3040 wrote to memory of 2716 3040 --library=m.exe 37 PID 3040 wrote to memory of 2716 3040 --library=m.exe 37 PID 3040 wrote to memory of 2716 3040 --library=m.exe 37 PID 3040 wrote to memory of 2700 3040 --library=m.exe 38 PID 3040 wrote to memory of 2700 3040 --library=m.exe 38 PID 3040 wrote to memory of 2700 3040 --library=m.exe 38 PID 3040 wrote to memory of 2700 3040 --library=m.exe 38 PID 3040 wrote to memory of 2336 3040 --library=m.exe 39 PID 3040 wrote to memory of 2336 3040 --library=m.exe 39 PID 3040 wrote to memory of 2336 3040 --library=m.exe 39 PID 3040 wrote to memory of 2336 3040 --library=m.exe 39 PID 3040 wrote to memory of 2936 3040 --library=m.exe 40 PID 3040 wrote to memory of 2936 3040 --library=m.exe 40 PID 3040 wrote to memory of 2936 3040 --library=m.exe 40 PID 3040 wrote to memory of 2936 3040 --library=m.exe 40 PID 3040 wrote to memory of 2796 3040 --library=m.exe 41 PID 3040 wrote to memory of 2796 3040 --library=m.exe 41 PID 3040 wrote to memory of 2796 3040 --library=m.exe 41 PID 3040 wrote to memory of 2796 3040 --library=m.exe 41 PID 3040 wrote to memory of 2808 3040 --library=m.exe 42 PID 3040 wrote to memory of 2808 3040 --library=m.exe 42 PID 3040 wrote to memory of 2808 3040 --library=m.exe 42 PID 3040 wrote to memory of 2808 3040 --library=m.exe 42 PID 3040 wrote to memory of 2900 3040 --library=m.exe 43 PID 3040 wrote to memory of 2900 3040 --library=m.exe 43 PID 3040 wrote to memory of 2900 3040 --library=m.exe 43 PID 3040 wrote to memory of 2900 3040 --library=m.exe 43 PID 3040 wrote to memory of 2668 3040 --library=m.exe 44 PID 3040 wrote to memory of 2668 3040 --library=m.exe 44 PID 3040 wrote to memory of 2668 3040 --library=m.exe 44 PID 3040 wrote to memory of 2668 3040 --library=m.exe 44
Processes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c color 131⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\啊哈C\core\bin\--library=m.exe"C:\Users\Admin\AppData\Local\Temp\啊哈C\core\bin\--library=m.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2752
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2720
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2716
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2336
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2796
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2808
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2900
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2668
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2624
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2644
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2140
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2740
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:304
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2888
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2916
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2432
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2420
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1476
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2236
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1260
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1644
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1244
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1256
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2036
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1084
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2016
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2192
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2072
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1924
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2220
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2664
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2520
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2968
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:532
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1424
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:1416
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:580
-