Overview
overview
10Static
static
7About.chm
windows7-x64
1About.chm
windows10-2004-x64
10Setup_s34.exe
windows7-x64
7Setup_s34.exe
windows10-2004-x64
10baid.exe
windows7-x64
7baid.exe
windows10-2004-x64
10bind_8152.exe
windows7-x64
7bind_8152.exe
windows10-2004-x64
10duisc.exe
windows7-x64
8duisc.exe
windows10-2004-x64
10edmtd.exe
windows7-x64
7edmtd.exe
windows10-2004-x64
10itadx.exe
windows7-x64
7itadx.exe
windows10-2004-x64
10ly2_03.exe
windows7-x64
10ly2_03.exe
windows10-2004-x64
10pcast.exe
windows7-x64
10pcast.exe
windows10-2004-x64
10pingtu12.exe
windows7-x64
1pingtu12.exe
windows10-2004-x64
10qqa02_u88setup.exe
windows7-x64
8qqa02_u88setup.exe
windows10-2004-x64
10sdcnc.exe
windows7-x64
8sdcnc.exe
windows10-2004-x64
10sdpig.exe
windows7-x64
7sdpig.exe
windows10-2004-x64
10sdreg.exe
windows7-x64
1sdreg.exe
windows10-2004-x64
10sdset.exe
windows7-x64
10sdset.exe
windows10-2004-x64
10sogoutb_se...ni.exe
windows7-x64
7sogoutb_se...ni.exe
windows10-2004-x64
10Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:27
Behavioral task
behavioral1
Sample
About.chm
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
About.chm
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Setup_s34.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
Setup_s34.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
baid.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
baid.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
bind_8152.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
bind_8152.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
duisc.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral10
Sample
duisc.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
edmtd.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
edmtd.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
itadx.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
itadx.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ly2_03.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
ly2_03.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
pcast.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
pcast.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
pingtu12.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
pingtu12.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
qqa02_u88setup.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
qqa02_u88setup.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
sdcnc.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
sdcnc.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
sdpig.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral26
Sample
sdpig.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
sdreg.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
sdreg.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
sdset.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
sdset.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
sogoutb_setup_pp365sosoft08mini.exe
Resource
win7-20231215-en
windows7-x64
General
-
Target
sdpig.exe
-
Size
125KB
-
MD5
1c0356a4d34f36e2ee3cba5ab3aaabd8
-
SHA1
13c218d5205bcd2d0b244278787629d6f4ee842e
-
SHA256
df8fc44f5b858f79a9cc033b6245e88aa829f057ad077aa379ada32dd4889434
-
SHA512
fb098eb6ed3dde834247eab7af2a5cb1644fdeaa5030e44d80d37dc898145925f4162a836499619d46bbf44fbe9a97d902f1aa69e30b1f3ee7c8fe44c30198ef
-
SSDEEP
3072:8sv1gkIVWIkWdn4V/nfQWIjfJ1AZDHuEz3BHG0x+:UhWJWd4UjR+ROEz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2052 Search.exe -
Loads dropped DLL 8 IoCs
pid Process 2620 regsvr32.exe 2884 sdpig.exe 2884 sdpig.exe 2052 Search.exe 2052 Search.exe 2052 Search.exe 2052 Search.exe 2884 sdpig.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MoveSearch = "C:\\Program Files (x86)\\wsearch\\Search.exe" Search.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 24 IoCs
description ioc Process File created C:\Program Files (x86)\wsearch\SearchM.dll sdpig.exe File opened for modification C:\Program Files (x86)\wsearch\sysadInfo.ini sdpig.exe File opened for modification C:\Program Files (x86)\wsearch\allverx.dat sdpig.exe File created C:\Program Files (x86)\wsearch\mupdate.exe.tmp sdpig.exe File created C:\Program Files (x86)\wsearch\mupdate.exe sdpig.exe File created C:\Program Files (x86)\wsearch\Search.exe sdpig.exe File opened for modification C:\Program Files (x86)\wsearch\Search.exe sdpig.exe File created C:\Program Files (x86)\wsearch\allverx.dat sdpig.exe File created C:\Program Files (x86)\wsearch\Mouse1.dll sdpig.exe File created C:\Program Files (x86)\wsearch\Search.exe.tmp sdpig.exe File created C:\Program Files (x86)\wsearch\sysupdate.ini sdpig.exe File created C:\Program Files (x86)\wsearch\SearchM.dll.tmp sdpig.exe File opened for modification C:\Program Files (x86)\wsearch\SearchM.dll sdpig.exe File opened for modification C:\Program Files (x86)\wsearch\sysupdate.ini sdpig.exe File created C:\Program Files (x86)\wsearch\setup.tmp sdpig.exe File created C:\Program Files (x86)\wsearch\_uninstall sdpig.exe File created C:\Program Files (x86)\wsearch\Mouse1.dll.tmp sdpig.exe File opened for modification C:\Program Files (x86)\wsearch\Mouse1.dll sdpig.exe File opened for modification C:\Program Files (x86)\wsearch\mUninstall.exe sdpig.exe File created C:\Program Files (x86)\wsearch\allverx.dat.tmp sdpig.exe File created C:\Program Files (x86)\wsearch\mUninstall.exe.tmp sdpig.exe File created C:\Program Files (x86)\wsearch\mUninstall.exe sdpig.exe File opened for modification C:\Program Files (x86)\wsearch\mupdate.exe sdpig.exe File created C:\Program Files (x86)\wsearch\sysupdate.ini.tmp sdpig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\InprocServer32\ = "C:\\PROGRA~2\\wsearch\\searchm.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib\ = "{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\CLSID\ = "{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\CurVer\ = "SearchM.Com.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\VersionIndependentProgID\ = "SearchM.Com" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\TypeLib\ = "{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com.1\ = "Com Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\ProgID\ = "SearchM.Com.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib\ = "{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ = "ICom" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\ = "Com Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com.1\CLSID\ = "{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\0\win32\ = "C:\\Program Files (x86)\\wsearch\\searchm.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ = "ICom" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\wsearch\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\ = "Com Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\ = "SearchM 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8} regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2884 sdpig.exe Token: SeBackupPrivilege 2884 sdpig.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2884 sdpig.exe 2052 Search.exe 2052 Search.exe 2052 Search.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2620 2884 sdpig.exe 28 PID 2884 wrote to memory of 2620 2884 sdpig.exe 28 PID 2884 wrote to memory of 2620 2884 sdpig.exe 28 PID 2884 wrote to memory of 2620 2884 sdpig.exe 28 PID 2884 wrote to memory of 2620 2884 sdpig.exe 28 PID 2884 wrote to memory of 2620 2884 sdpig.exe 28 PID 2884 wrote to memory of 2620 2884 sdpig.exe 28 PID 2884 wrote to memory of 2052 2884 sdpig.exe 34 PID 2884 wrote to memory of 2052 2884 sdpig.exe 34 PID 2884 wrote to memory of 2052 2884 sdpig.exe 34 PID 2884 wrote to memory of 2052 2884 sdpig.exe 34 PID 2884 wrote to memory of 2052 2884 sdpig.exe 34 PID 2884 wrote to memory of 2052 2884 sdpig.exe 34 PID 2884 wrote to memory of 2052 2884 sdpig.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\sdpig.exe"C:\Users\Admin\AppData\Local\Temp\sdpig.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\wsearch\searchm.dll" -s2⤵
- Loads dropped DLL
- Modifies registry class
PID:2620
-
-
C:\Program Files (x86)\wsearch\Search.exe"C:\Program Files (x86)\wsearch\Search.exe" us2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD51347396bc1c22564878cb94f3b810404
SHA1d92d425ba15404c081a2e597ebdd74ac7cda17f1
SHA256c928218d0244e1c8f8b78ae474c0d8805d1ab1033ef437dbec60c730993de6c9
SHA512a37f1637ed55cff8280b790632f023cd4c3b6bdf98eb5d95e4a2a0aaa6a56e2e2ba48ca1779c8cbf92202304ff3dbc6627aaa09bb4a557e419830c5bda15c238
-
Filesize
64KB
MD523dc474fa7d3f168893a0636ec39e8b3
SHA11d20d251dde02aaa1b34c8681f7a2f60b5af98cf
SHA256b7063981dc266732e4cc464a07f2eca1e2b0aa5cb8d792199051bd7771a0661a
SHA51275e43e5963b07da4550416593453557a789041f5a662071de59a49f0cffa8fae748b1ab02f464f24a8facdc078923834b0a4ee23309b6c7438a06ba2ffe47097
-
Filesize
88KB
MD5610595ff326d38e997796d9725c1db1c
SHA1a2c4e29148d1b2a3cfc4f88938a39d60791186d4
SHA256983652684d3cc24262fdcc587f3f2a7c1e2118b3d7ac4ee760d876a1ef03a86e
SHA512021d063aeb23134c2332986c0a800c64e7a9f660018f3ec5ce1f5e7f487de6cf6b329908869a01b20426cc119c90a3daa880b82bbff86587eba5aaa7538e4a43