Overview
overview
7Static
static
3QQLive3.5.exe
windows7-x64
7QQLive3.5.exe
windows10-2004-x64
7$PLUGINSDI...ne.dll
windows7-x64
3$PLUGINSDI...ne.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3ADManage.dll
windows7-x64
3ADManage.dll
windows10-2004-x64
3BalloonTip.dll
windows7-x64
1BalloonTip.dll
windows10-2004-x64
1COMToolKit.dll
windows7-x64
1COMToolKit.dll
windows10-2004-x64
1CacheFile/...ds.htm
windows7-x64
1CacheFile/...ds.htm
windows10-2004-x64
1CacheFile/ShowPay.htm
windows7-x64
1CacheFile/ShowPay.htm
windows10-2004-x64
1CacheFile/...ex.htm
windows7-x64
1CacheFile/...ex.htm
windows10-2004-x64
1ExceptCatch.dll
windows7-x64
3ExceptCatch.dll
windows10-2004-x64
3GdiPlus.dll
windows7-x64
3GdiPlus.dll
windows10-2004-x64
3LiveAPI.dll
windows7-x64
1LiveAPI.dll
windows10-2004-x64
1LiveStream.dll
windows7-x64
1LiveStream.dll
windows10-2004-x64
MagicFlash.exe
windows7-x64
1MagicFlash.exe
windows10-2004-x64
1Analysis
- max time kernel
143s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/03/2024, 16:39
Static task
static1
Behavioral task
behavioral1
Sample
QQLive3.5.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
QQLive3.5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/CmdLine.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/CmdLine.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/procdll.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/procdll.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ADManage.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
ADManage.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
BalloonTip.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
BalloonTip.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
COMToolKit.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral16
Sample
COMToolKit.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
CacheFile/ScrWords.htm
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
CacheFile/ScrWords.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
CacheFile/ShowPay.htm
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
CacheFile/ShowPay.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
CacheFile/index_loge_normal/index.htm
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral22
Sample
CacheFile/index_loge_normal/index.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
ExceptCatch.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral24
Sample
ExceptCatch.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
GdiPlus.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
GdiPlus.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
LiveAPI.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
LiveAPI.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
LiveStream.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
LiveStream.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
MagicFlash.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
MagicFlash.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target QQLive3.5.exe
- Size 4.4MB
- Sample240311-t5zcfabe84
- SHA256 2f41164e2eff2be909b0b6fa89a265858729e29b19510d0bed368e9571e530d1
- MD5 8a787da56b8c0b2cc835c0991c521e04
- SHA1 4747caa4442d7482a8b11421f4625f23d0b5ae00
- SHA512 75b9d3e416ed8c85c35abcced80094e60a10725f0e7a820770aaa5de8e2a0aea9f069a9665e2562fd5617338936c81dd831e365028342cf6e16f9936e97c9d5e
- SSDEEP 98304:4XOCmBmRyV0z3BKunzPTK8acH34NbPM+41znN2WXleaP:aRwV0j0uzPTpacHOjMJBVXYaP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 11 IoCs
pid Process 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qqlive QQLive3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qqlive\ = "1" QQLive3.5.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe 2544 QQLive3.5.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsz39AF.tmp\CmdLine.dll
- Size 4KB
- SHA256 af9ac758fad5ae60c9088af32f139957b53773e834bf8e1dc8e723679e5769bf
- MD5 edf61ca7c9289936047cd0f378e961a5
- SHA1 6519f848d76662d1e3c4c9792947c07e5c5165b9
- SHA512 2ddba165a20886299ae8af2ebfb1cdc184ec75a5665fd83971d6e4a5296d2ed23001cbc01eb01e2d653214710e58719c1b8d31113a0e46e6f106826bbaad397c
- SSDEEP 24:e1GSQevP8oN42tGv+zCdd0RdJf6lhof1BEJpyqI7xogNNqtvuPqQV1tLwlWg5dhT:SQc8pzWq2JfIhhPI7M2/LG5dTYP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsz39AF.tmp\InstallOptions.dll
- Size 12KB
- SHA256 191fab998e58b66a2416873b06062166b547eb3ba06b1326a4a785a566aaf76d
- MD5 f407939127208a009b9a825cb77ed3c7
- SHA1 051d7fccf3fb544acaa8ab6be590bb4bc79cef82
- SHA512 d45d08823ac7667f071b21d238b7fda43115db3195a442cb17d880d147e8a930374403c970afc31f676f01a83fb9c63e3be047de7e16718a08a1fdbe4b690901
- SSDEEP 192:hzixixDOHhG9db9rd+oSVPECMlh3I8tqDyn/7hwbbHF1QuCb:hOx0DOHqrdwTY6+n/72bbMum
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsz39AF.tmp\KillProcDLL.dll
- Size 4KB
- SHA256 e594544cc4b4a0a5439a2b9a79db14e580d815c87e353781c47d4eab5e313b8e
- MD5 c1e153f9fa1001eb9fb34bbc4a3f3927
- SHA1 dfca2dcce9b0486114692a23776191627b0c9839
- SHA512 d2a7c2853b56f60f710dcea27c346dbd22593c98e5c000c22650613851f26e505b12260bcfc050473e97c2796a91c94a3c201785dad4d95de0b4e2de35c3a41f
- SSDEEP 48:C4ojqpOxUcbslAR1k5eKv8rbvHMgiqCmZuwJQ7TLSMXaIYatzbgAa4l5YAZ:SEeFslARoeK8rDHMgTCmj/MqoRb+4l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsz39AF.tmp\ioSpecial.ini
- Size 762B
- SHA256 1d03bc435c6b010387c0ba37f6e0366ccece1229eff27640ff3d2119392f3463
- MD5 9d9b26f4ac03c0a30770990caad40af5
- SHA1 9ece6dfd8dcb4e50a6232958122e113ddfee367e
- SHA512 4b6d0f41957205826eb252572122a4aa86a253972ea82127dcf37fba5204f200cd532c9ab46a587a806c22b8014e958f9e483e5b7d83ab0b5433d6c584991fe0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsz39AF.tmp\procdll.dll
- Size 4KB
- SHA256 291a74090610ebf38b0968ea72fc26cc538fe21eaddf5e1383aa0bccbcb36e60
- MD5 7db3aa454b55d24d6b8266d79f3e8bab
- SHA1 3bab133e42c5e94711f2994b7d57a3746713cf36
- SHA512 afeaca5a5d6863eaac9e671ffcf62b12f9ec6b5ab79f10c39d48f248f01d1d4048e95ec0e31dcea8878595192acb42bb8aabec41235377d901fd44db9101c885
- MD5 SHA1 SHA512