Overview

overview

7

Static

static

7

BaiduEdito..._2.exe

windows7-x64

7

BaiduEdito..._2.exe

windows10-2004-x64

4

$PLUGINSDI...ol.dll

windows7-x64

7

$PLUGINSDI...ol.dll

windows10-2004-x64

7

$PLUGINSDIR/CLR.dll

windows7-x64

1

$PLUGINSDIR/CLR.dll

windows10-2004-x64

1

$PLUGINSDI...ig.dll

windows7-x64

3

$PLUGINSDI...ig.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDIR/ip.dll

windows7-x64

3

$PLUGINSDIR/ip.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows7-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...og.dll

windows7-x64

3

$PLUGINSDI...og.dll

windows10-2004-x64

3

$PLUGINSDIR/time.dll

windows7-x64

3

$PLUGINSDIR/time.dll

windows10-2004-x64

3

7za.exe

windows7-x64

1

7za.exe

windows10-2004-x64

1

BaiduEdito...on.dll

windows7-x64

1

BaiduEdito...on.dll

windows10-2004-x64

1

Resubmissions

14/02/2024, 10:18

240214-mcaeaafg4y 7

14/02/2024, 10:16

240214-masg3sgg75 7

Analysis

  • max time kernel
    93s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 10:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    BaiduEditor(Offline)_6_5_5_2.exe

  • Size

    22.0MB

  • MD5

    55c30515dc8d564651d7d35fcd9ff97d

  • SHA1

    02eafdb262eb7b43e9997c6f9924c2f4ff4f1285

  • SHA256

    9868e15ce5dee4ac08bbb900151fae026a036f5f80c9b6bc5f8746b64002aec5

  • SHA512

    c432bbb95b0392c934bf035b6a7a7a5efd465ac79909a3ccea6999275840d5dc6060e297c6425aac3f36b867fdb3e506f5205808516675d3b6da6269d6ee4a64

  • SSDEEP

    393216:3GTzJ8ZZxCywDCgXjsB6Uyk8GpF+ANND9aBqvEIlyhz/w9+MpJCL1WdFmW5cMFSz:EKZsugzsEUySD+AT89Y8xm1FuS451ADk

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BaiduEditor(Offline)_6_5_5_2.exe
    "C:\Users\Admin\AppData\Local\Temp\BaiduEditor(Offline)_6_5_5_2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:3548

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsp5238.tmp\LangDLL.dll
          Filesize

          5KB

          MD5

          f3a5b5ee30a039a4c136f7718b768c54

          SHA1

          8030564028871328a67fd7184c6f6476fa5d3cab

          SHA256

          2a5d0cf98084a3e9cd6d0007fcdd39810164ec82e74c513d51ab51bd85866b1a

          SHA512

          861635ba6e139516cb9316723bdf8b5022178f660b2234bd48212a1992391f727d33bf8f6c88976b5c78979916b879d2d614b99205ee41cc33c5046f17558b01

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsp5238.tmp\System.dll
          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsp5238.tmp\UserInfo.dll
          Filesize

          4KB

          MD5

          7579ade7ae1747a31960a228ce02e666

          SHA1

          8ec8571a296737e819dcf86353a43fcf8ec63351

          SHA256

          564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

          SHA512

          a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsp5238.tmp\install-header5.bmp
          Filesize

          83KB

          MD5

          defbcd0d6cef12fde99fbc63538ef2e2

          SHA1

          ad0bb2871f8e6ab8b71008da1b50357196c53c1d

          SHA256

          50708e537a01091a2cf91df5eeb414ffb47905d3d74da606d21162b784fee2a6

          SHA512

          a8bb4c2481332f78857dd3335393fbb9c40f4494fc846835e44d0d633ecb5225fed786b0edfb5126482449450cd55f102c76449d2549fb4ef7be9abc5b7e9c7e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsp5238.tmp\nsProcess.dll
          Filesize

          4KB

          MD5

          faa7f034b38e729a983965c04cc70fc1

          SHA1

          df8bda55b498976ea47d25d8a77539b049dab55e

          SHA256

          579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

          SHA512

          7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsp5238.tmp\nsislog.dll
          Filesize

          42KB

          MD5

          e47100b70748fc790ffe6299cdf7ef2d

          SHA1

          ad2a9cd5f7c39121926b7c131816e7ba85aeead2

          SHA256

          271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

          SHA512

          88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsp5238.tmp\time.dll
          Filesize

          10KB

          MD5

          38977533750fe69979b2c2ac801f96e6

          SHA1

          74643c30cda909e649722ed0c7f267903558e92a

          SHA256

          b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

          SHA512

          e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

          Download Submit

        • memory/3548-10-0x0000000003060000-0x0000000003070000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3548-100-0x0000000002850000-0x0000000002860000-memory.dmp

          Filesize

          64KB

          Download