Overview
overview
3Static
static
3Consolex.exe
windows7-x64
1Consolex.exe
windows10-2004-x64
1Plugs/TOPI...eU.dll
windows7-x64
1Plugs/TOPI...eU.dll
windows10-2004-x64
1Styles/Office2007.dll
windows7-x64
1Styles/Office2007.dll
windows10-2004-x64
1TbMate.exe
windows7-x64
1TbMate.exe
windows10-2004-x64
1apsystem.dll
windows7-x64
1apsystem.dll
windows10-2004-x64
1fluorinepp.dll
windows7-x64
3fluorinepp.dll
windows10-2004-x64
3gtJpeg.dll
windows7-x64
1gtJpeg.dll
windows10-2004-x64
1help.html
windows7-x64
1help.html
windows10-2004-x64
1msi.dll
windows7-x64
1msi.dll
windows10-2004-x64
1xEngine.exe
windows7-x64
1xEngine.exe
windows10-2004-x64
1xWeb.dll
windows7-x64
1xWeb.dll
windows10-2004-x64
1新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
Consolex.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Consolex.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Plugs/TOPInterfaceU.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Plugs/TOPInterfaceU.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Styles/Office2007.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Styles/Office2007.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
TbMate.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
TbMate.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
apsystem.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
apsystem.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
fluorinepp.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
fluorinepp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
gtJpeg.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
gtJpeg.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
help.html
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
help.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
msi.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
msi.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
xEngine.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
xEngine.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
xWeb.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
xWeb.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
新云软件.url
Resource
win10v2004-20240226-en
General
-
Target
xEngine.exe
-
Size
1.3MB
-
MD5
041bb0adc2bdb383d56c3c969228689a
-
SHA1
707a9d6ac0bec0b1ef8617bea2d5e88ecdd01b86
-
SHA256
520703ed02b0b7fe51dbf2e930b6ef33c5e4b65108810ebf2ea3cd27f31ca6b4
-
SHA512
238474bc22368c049677d41565fbe73c16602dd7e920045a0113da99f7e3ffa81f0d32fd2b5d5b8787fcdbcfafbdcea3543ef5a714565bd5aa59b5af06818b09
-
SSDEEP
24576:jj4hE854lTcjrZxuR5HBrZUlI9sF9ngJ4D+sLBMeXWyATL7zXXTX12Oe:jEhEBlTIZxgdgosF9gJUdMeXWyqLXTl6
Malware Config
Signatures
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ECTP xEngine.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ECTP\shell xEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ECTP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xEngine.exe" xEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ECTP\URL Protocol xEngine.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ECTP\shell\open\command xEngine.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ECTP\shell\open xEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ECTP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xEngine.exe\" \"%1\"" xEngine.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ECTP\DefaultIcon xEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ECTP\ = "URL: ECTP Protocol" xEngine.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 xEngine.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2172 xEngine.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2172 xEngine.exe 2172 xEngine.exe 2172 xEngine.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
867KB
MD506e98cfe66d5e323aeb94a393b41492e
SHA123c1066859e0055bf7efd02eb9911819c0e92e77
SHA25663eb9274f807fe9e53ed18cba1519a8487d285c3b902477c49266ddff4ada0d1
SHA512ab63ce7b638cb87b8d6aa23e6fdd2da124874a6efd4a103377c9c010d3029f39bbc8ab50e8780deab64e2f50fc5fdf36de99cfccaff52580e79cf5357906846b