Overview
overview
7Static
static
7ada83f24db...0a.exe
windows7-x64
7ada83f24db...0a.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$TEMPLATES/Setup.exe
windows7-x64
7$TEMPLATES/Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3KKjie.exe
windows7-x64
7KKjie.exe
windows10-2004-x64
7$EXEDIR/KK...fe.exe
windows7-x64
1$EXEDIR/KK...fe.exe
windows10-2004-x64
1$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3KKjie_safe.exe
windows7-x64
1KKjie_safe.exe
windows10-2004-x64
1KKjie_safe.dll
windows7-x64
1KKjie_safe.dll
windows10-2004-x64
1languages/Chinese.dll
windows7-x64
1languages/Chinese.dll
windows10-2004-x64
1xiezai.exe
windows7-x64
7xiezai.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$TEMPLATES...ft.exe
windows7-x64
1$TEMPLATES...ft.exe
windows10-2004-x64
1$TEMPLATES...ft.exe
windows7-x64
1$TEMPLATES...ft.exe
windows10-2004-x64
1$TEMPLATES/readme.exe
windows7-x64
7$TEMPLATES/readme.exe
windows10-2004-x64
7Analysis
-
max time kernel
147s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 04:11
Behavioral task
behavioral1
Sample
ada83f24db805cdc68a240df31289f0a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ada83f24db805cdc68a240df31289f0a.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMPLATES/Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMPLATES/Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
KKjie.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
KKjie.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$EXEDIR/KKjie_safe.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$EXEDIR/KKjie_safe.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
KKjie_safe.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
KKjie_safe.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
KKjie_safe.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
KKjie_safe.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
languages/Chinese.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
languages/Chinese.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
xiezai.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
xiezai.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
$TEMPLATES/lianmena/tsoft.exe
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
$TEMPLATES/lianmena/tsoft.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
$TEMPLATES/lianmeng/tsoft.exe
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$TEMPLATES/lianmeng/tsoft.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
$TEMPLATES/readme.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$TEMPLATES/readme.exe
Resource
win10v2004-20240226-en
General
-
Target
xiezai.exe
-
Size
45KB
-
MD5
6e4c948407b43e2bf15c9bbef5e2b35e
-
SHA1
de139fe1114aeaf8064379afdeb32184cb852d32
-
SHA256
8e76e356a9b92f70ed731d96eab90d59586a7e53d3c4bc6a50f1347546c2a992
-
SHA512
471e204f9426fd9d250ba02b1b0f08add3cc22d31c718f43efe567987399a8858f7236672d94a7623a16b6b29a0cdd04bae6883c2c642a97ff188d8aac203db1
-
SSDEEP
768:nvfkFhTjNfFgYkmQXyZxM5nndpvwSOy10DW4jM4gJZJ9DMBM3MJJmCB9asnRvOXW:vfkzTjNfFzfcPn7o/DW2M4gJFMJJmC1t
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3484 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 3484 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral24/files/0x000700000002327b-3.dat nsis_installer_1 behavioral24/files/0x000700000002327b-3.dat nsis_installer_2 -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B7C13A-E9CD-4959-8B46-FBEAB41E42A8}\InprocServer32\ = "E:\\\\WINDOWS\\\\system32\\\\urlFilter.dll" Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\InprocServer32 Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D} Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B7C13A-E9CD-4959-8B46-FBEAB41E42A8}\InprocServer32 Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID Au_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\InprocServer32\ = "G:\\\\Program Files\\\\360safe\\\\safemon\\\\safemon.dll" Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} Au_.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3484 Au_.exe 3484 Au_.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4936 wrote to memory of 3484 4936 xiezai.exe 89 PID 4936 wrote to memory of 3484 4936 xiezai.exe 89 PID 4936 wrote to memory of 3484 4936 xiezai.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\xiezai.exe"C:\Users\Admin\AppData\Local\Temp\xiezai.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
45KB
MD56e4c948407b43e2bf15c9bbef5e2b35e
SHA1de139fe1114aeaf8064379afdeb32184cb852d32
SHA2568e76e356a9b92f70ed731d96eab90d59586a7e53d3c4bc6a50f1347546c2a992
SHA512471e204f9426fd9d250ba02b1b0f08add3cc22d31c718f43efe567987399a8858f7236672d94a7623a16b6b29a0cdd04bae6883c2c642a97ff188d8aac203db1