Overview
overview
7Static
static
37fb449e7e6...ea.exe
windows7-x64
77fb449e7e6...ea.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3Manager/genHomevw.exe
windows7-x64
1Manager/genHomevw.exe
windows10-2004-x64
1Server/AppSvr_n.exe
windows7-x64
1Server/AppSvr_n.exe
windows10-2004-x64
1Server/DBMgr.exe
windows7-x64
1Server/DBMgr.exe
windows10-2004-x64
1Server/DlxSvcS_n.exe
windows7-x64
1Server/DlxSvcS_n.exe
windows10-2004-x64
1Server/FCUtil.exe
windows7-x64
4Server/FCUtil.exe
windows10-2004-x64
4Server/His...on.exe
windows7-x64
1Server/His...on.exe
windows10-2004-x64
1Server/Mig...DB.exe
windows7-x64
1Server/Mig...DB.exe
windows10-2004-x64
1Server/Patcher.exe
windows7-x64
1Server/Patcher.exe
windows10-2004-x64
1Server/Pro...te.exe
windows7-x64
1Server/Pro...te.exe
windows10-2004-x64
1Server/Server_n.exe
windows7-x64
4Server/Server_n.exe
windows10-2004-x64
4Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
7fb449e7e61d7f7d41ef63d4b9df44ea.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7fb449e7e61d7f7d41ef63d4b9df44ea.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Manager/genHomevw.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Manager/genHomevw.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
Server/AppSvr_n.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Server/AppSvr_n.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Server/DBMgr.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Server/DBMgr.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
Server/DlxSvcS_n.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
Server/DlxSvcS_n.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
Server/FCUtil.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
Server/FCUtil.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
Server/HistoryDeleteSecondEdition.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
Server/HistoryDeleteSecondEdition.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Server/MigrationDB.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
Server/MigrationDB.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
Server/Patcher.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
Server/Patcher.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
Server/PromptExecute.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
Server/PromptExecute.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
Server/Server_n.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
Server/Server_n.exe
Resource
win10v2004-20231215-en
General
-
Target
Server/MigrationDB.exe
-
Size
2.0MB
-
MD5
f9ea08c60da5a5d874283cb599192ebf
-
SHA1
6b223031b7f12a024850ceca05139fe152591c7d
-
SHA256
c4e815bac15c40af38596dd276da7f69fbe442844ce6e63d9da88880ebd2a097
-
SHA512
a7486a947bc51c30b6853d019df42fbba0131bec2695b94c1f984435b6f6be12e20d8ab361f705fc528263d3558a09f08af20a70ba6ca9da25cba8c687c39d2f
-
SSDEEP
24576:wBpw7H9DT1UnTAxsRGm2uuzV7nNzVD6kovft+/1CRT3ZqeMqGm0A7kIDuSXD:anTjmlVn/CTuzYxDu
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1228 MigrationDB.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1228 MigrationDB.exe 1228 MigrationDB.exe 1228 MigrationDB.exe