Overview
overview
7Static
static
7cool-3gp-c...gb.exe
windows7-x64
7cool-3gp-c...gb.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3Cool3GPConverter.exe
windows7-x64
3Cool3GPConverter.exe
windows10-2004-x64
3Cool3GPCon...gb.chm
windows7-x64
1Cool3GPCon...gb.chm
windows10-2004-x64
1libm9s.exe
windows7-x64
1libm9s.exe
windows10-2004-x64
1shellMenu_gb.dll
windows7-x64
1shellMenu_gb.dll
windows10-2004-x64
1update.exe
windows7-x64
1update.exe
windows10-2004-x64
1xvidcore.dll
windows7-x64
1xvidcore.dll
windows10-2004-x64
1新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
28/02/2024, 13:21
Behavioral task
behavioral1
Sample
cool-3gp-converter-gb.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
cool-3gp-converter-gb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Cool3GPConverter.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
Cool3GPConverter.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Cool3GPConverter_gb.chm
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
Cool3GPConverter_gb.chm
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
libm9s.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
libm9s.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
shellMenu_gb.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
shellMenu_gb.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
update.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
update.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
xvidcore.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
xvidcore.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
新云软件.url
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
新云软件.url
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target update.exe
- Size 643KB
- Sample240228-qlrayace5w
- SHA256 8bdc29730d79e5a781ba553997a4ead791d44b63ed2632667a2976e50ed02d33
- MD5 5e7d561a38e02a93cb6b6896f0fbf821
- SHA1 478dc732666d0e1a732104b616c23ab2bf37fc03
- SHA512 e005675f5cb11ad1aaf23b171669427989ddcd310ca28d5d8067e0d2569e114fb9ae5a10822b6e9ee964900c2bd54eefc008c9115c92aee52945a78e36b314df
- SSDEEP 12288:EQ/b1QYb9Ify+sRp66qHbJrEeQW2T/PKzNNLQy92eMlTsWZK:p/Fb9MME6q7i+22HPMlTD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe 1572 update.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1572 update.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Update.ini
- Size 400B
- SHA256 1aacf6beb76c62a27c6844c8ebdbf7be08f11df1e35c3dbf5bc1fee86efbd67c
- MD5 92a2cbcab4cee6963d1ad995193dda3d
- SHA1 8ded36f499a48cf39e35626381c04fa7b8364533
- SHA512 c795724555caf3c34557b4a993d2151fe2b7f4617d73a58d758bd746128cfce12af3c744938daf7953d3e4ec69cceebc56ce8f2763850391d33df6dbfbc98220
- MD5 SHA1 SHA512