Overview
overview
7Static
static
7Vw3Setup.exe
windows7-x64
7Vw3Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3SDK/vsidasp.vbs
windows7-x64
1SDK/vsidasp.vbs
windows10-2004-x64
VirtualWall.dll
windows7-x64
1VirtualWall.dll
windows10-2004-x64
1VwCfgNew.exe
windows7-x64
6VwCfgNew.exe
windows10-2004-x64
6VwClient/VwClient.dll
windows7-x64
7VwClient/VwClient.dll
windows10-2004-x64
7VwClient/V...fg.exe
windows7-x64
1VwClient/V...fg.exe
windows10-2004-x64
1VwHelpZhcn.chm
windows7-x64
1VwHelpZhcn.chm
windows10-2004-x64
1VwUpdate.exe
windows7-x64
1VwUpdate.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/03/2024, 05:46
Behavioral task
behavioral1
Sample
Vw3Setup.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
Vw3Setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
SDK/vsidasp.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
SDK/vsidasp.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
VirtualWall.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
VirtualWall.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
VwCfgNew.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
VwCfgNew.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
VwClient/VwClient.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
VwClient/VwClient.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
VwClient/VwClientCfg.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
VwClient/VwClientCfg.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
VwHelpZhcn.chm
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
VwHelpZhcn.chm
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
VwUpdate.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
VwUpdate.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
uninst.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
uninst.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
新云软件.url
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
新云软件.url
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target Vw3Setup.exe
- Size 2.6MB
- Sample240304-ggf5qscc75
- SHA256 257901ed4baf9b723706c064c0d8c3c074989b712ca3f53aa17207febaf4e01a
- MD5 000f9cf40f83d513f311939a9f023ad4
- SHA1 2b9891f3edc08dbea9ccc140703c6b6c1986fef4
- SHA512 68fb4dfea7e54520c1fddc90055ac8746a5ba8ec47c85bf10b7d0ea1b20a2e6f351438d483eb867fe1972ea1d979edf8ff2a1d2c3a11221032e5d8b46656f626
- SSDEEP 49152:ud8y7aY6fOLhUoK28M6wazV+RQBJSiglyuRBV5PqDy9l3Zm0L+A7TkKdUO:w5aY6yvD1GpOyurPIynPxTkKdd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 4152 Vw3Setup.exe 4152 Vw3Setup.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsi5C0B.tmp\InstallOptions.dll
- Size 12KB
- SHA256 a505e6c537a5ce0166227dda9f7671605395592ac9f1a3764e8a01b713939db1
- MD5 07f3b3445f66e1089567796bf3c8be78
- SHA1 851eb574c1067b23a654f8aa47b17ef599b24d1c
- SHA512 8c56308fff3a947b26fd0d98dbdd96c406ddf967f5d7abee8cba082b6c46a4e575094bb0bb981551ac5160bb5089cf6fb125dd17a659c427e28c07402adab1c3
- SSDEEP 192:pzi5iBjGHp29db9Dd+w6VPESclh3I8dYvwqu7hwbbHF1QuCb:pO5kjGHSDdgjo6pvwqu72bbMum
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi5C0B.tmp\LangDLL.dll
- Size 5KB
- SHA256 799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
- MD5 2c3c8976d729d28478a789217a882291
- SHA1 10c18b23fac957419547ef0f8ec3bc1b10e91e79
- SHA512 749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213
- SSDEEP 48:aefTYzqi+/XC1aQbkMIwovgxbLuwOWd8s/d79C6O4MWNEYJvRZJ0dfh80:22XC1XkH/ohLZDSs/d799O4MQE0R4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi5C0B.tmp\ioSpecial.ini
- Size 712B
- SHA256 3fa8a8c9cc3781ba5037eb3ed0c32e6fbf79733a4522df057f2b249429eae76b
- MD5 d981633c8b1ba81f2512c1f77ba063da
- SHA1 a4b2288e5b38e0b7991a19be2b33962b6ccd6ba0
- SHA512 85ffe100e180059c7ca59c7963a0d999e14cf8556563dd54c91e097de8ef16f712001d4b30a87863ff2fcf6dcdd93cd37103ce3e8a47b439611f3f6d92239e75
- MD5 SHA1 SHA512