Overview
overview
10Static
static
7GongShaFuZ...ll.dll
windows7-x64
1GongShaFuZ...ll.dll
windows10-2004-x64
1GongShaFuZ...LE.dll
windows7-x64
1GongShaFuZ...LE.dll
windows10-2004-x64
3GongShaFuZ...SG.dll
windows7-x64
1GongShaFuZ...SG.dll
windows10-2004-x64
3GongShaFuZ...AD.dll
windows7-x64
1GongShaFuZ...AD.dll
windows10-2004-x64
1GongShaFuZ...LL.dll
windows7-x64
1GongShaFuZ...LL.dll
windows10-2004-x64
1GongShaFuZ...OU.dll
windows7-x64
7GongShaFuZ...OU.dll
windows10-2004-x64
7GongShaFuZ...ER.dll
windows7-x64
1GongShaFuZ...ER.dll
windows10-2004-x64
1GongShaFuZ...ON.dll
windows7-x64
1GongShaFuZ...ON.dll
windows10-2004-x64
1GongShaFuZ...OW.dll
windows7-x64
1GongShaFuZ...OW.dll
windows10-2004-x64
3GongShaFuZ...ll.dll
windows7-x64
10GongShaFuZ...ll.dll
windows10-2004-x64
10GongShaFuZ...dm.dll
windows7-x64
10GongShaFuZ...dm.dll
windows10-2004-x64
10GongShaFuZ...lp.doc
windows7-x64
4GongShaFuZ...lp.doc
windows10-2004-x64
1GongShaFuZ....3.exe
windows7-x64
1GongShaFuZ....3.exe
windows10-2004-x64
1GongShaFuZ...er.exe
windows7-x64
1GongShaFuZ...er.exe
windows10-2004-x64
3GongShaFuZ...��.url
windows7-x64
1GongShaFuZ...��.url
windows10-2004-x64
1Analysis
-
max time kernel
0s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 09:55
Behavioral task
behavioral1
Sample
GongShaFuZhu13/【x1】攻沙辅助/cfgdll.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
GongShaFuZhu13/【x1】攻沙辅助/cfgdll.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/FILE.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/FILE.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/MSG.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/MSG.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/READ.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/READ.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/REGDLL.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/REGDLL.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/REMOTEANSWER_JDYOU.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/REMOTEANSWER_JDYOU.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/SGUOBROWSER.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/SGUOBROWSER.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/WEBOPERATION.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/WEBOPERATION.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/WINDOW.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/WINDOW.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/RegDll.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/RegDll.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/dm.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/dm.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/help.doc
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/help.doc
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
GongShaFuZhu13/【x1】攻沙辅助/攻沙辅助v1.3.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
GongShaFuZhu13/【x1】攻沙辅助/攻沙辅助v1.3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器-Browser.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器-Browser.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
GongShaFuZhu13/游迅网.url
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
GongShaFuZhu13/游迅网.url
Resource
win10v2004-20231215-en
General
-
Target
GongShaFuZhu13/【x1】攻沙辅助/xgs/RegDll.dll
-
Size
84KB
-
MD5
a2d61eff3148f2c70404927c0146306e
-
SHA1
cd9f8247d726a9b437a49a5824dbad9b1a6928a7
-
SHA256
7f5183494801b0b4314fe387589b7d5d41e03025dff3dde70f7c7e09723ef5c1
-
SHA512
d2eff12a8baa1911ec2f28c43243afb7fcbbe3e6cdeb799364db95089fd370dc8f30b49c7ea3eb81ae4b846e29860428a84c96497ecdb1f5f928200605fc5e00
-
SSDEEP
1536:I2FWCT03n3KYFcZvi5/0LI6LdEavoWZpEkt/Edm50E:lFWCT03n3KyyqmJFbpEOE0C
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3612 regsvr32Srv.exe 2696 DesktopLayer.exe -
resource yara_rule behavioral20/memory/3612-4-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral20/memory/2696-11-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral20/memory/2696-15-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral20/files/0x0009000000023214-12.dat upx behavioral20/memory/3612-6-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32Srv.exe regsvr32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px4DF1.tmp regsvr32Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe regsvr32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe regsvr32Srv.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6AD51FFD-AF9E-11EE-AA35-667A6D636A0F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.RegDll\CLSID\ = "{34531331-126E-4FC8-B430-1C6143484AA9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\ProgID\ = "QMPlugin.RegDll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GongShaFuZhu13\\?x1?????\\xgs\\RegDll.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.RegDll regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.RegDll\ = "QMPlugin.RegDll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\ = "QMPlugin.RegDll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.RegDll\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\InProcServer32 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2696 DesktopLayer.exe 2696 DesktopLayer.exe 2696 DesktopLayer.exe 2696 DesktopLayer.exe 2696 DesktopLayer.exe 2696 DesktopLayer.exe 2696 DesktopLayer.exe 2696 DesktopLayer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4216 iexplore.exe 4216 iexplore.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 5040 wrote to memory of 3584 5040 regsvr32.exe 14 PID 5040 wrote to memory of 3584 5040 regsvr32.exe 14 PID 5040 wrote to memory of 3584 5040 regsvr32.exe 14 PID 3584 wrote to memory of 3612 3584 regsvr32.exe 24 PID 3584 wrote to memory of 3612 3584 regsvr32.exe 24 PID 3584 wrote to memory of 3612 3584 regsvr32.exe 24 PID 3612 wrote to memory of 2696 3612 regsvr32Srv.exe 23 PID 3612 wrote to memory of 2696 3612 regsvr32Srv.exe 23 PID 3612 wrote to memory of 2696 3612 regsvr32Srv.exe 23 PID 2696 wrote to memory of 4216 2696 DesktopLayer.exe 21 PID 2696 wrote to memory of 4216 2696 DesktopLayer.exe 21 PID 4216 wrote to memory of 464 4216 iexplore.exe 19 PID 4216 wrote to memory of 464 4216 iexplore.exe 19 PID 4216 wrote to memory of 464 4216 iexplore.exe 19
Processes
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\xgs\RegDll.dll1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\regsvr32Srv.exeC:\Windows\SysWOW64\regsvr32Srv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3612
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\xgs\RegDll.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5040
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4216 CREDAT:17410 /prefetch:21⤵PID:464
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee