Overview

overview

7

Static

static

7

QQ.exe

windows7-x64

5

QQ.exe

windows10-2004-x64

7

QQ寻友�...��.htm

windows7-x64

1

QQ寻友�...��.htm

windows10-2004-x64

1

WinPcap_3_1.exe

windows7-x64

1

WinPcap_3_1.exe

windows10-2004-x64

1

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/nsWeb.dll

windows7-x64

3

$PLUGINSDIR/nsWeb.dll

windows10-2004-x64

3

$PLUGINSDIR/nxs.dll

windows7-x64

1

$PLUGINSDIR/nxs.dll

windows10-2004-x64

1

$SYSDIR/Packet.dll

windows7-x64

1

$SYSDIR/Packet.dll

windows10-2004-x64

1

$SYSDIR/WanPacket.dll

windows7-x64

1

$SYSDIR/WanPacket.dll

windows10-2004-x64

1

$SYSDIR/dr...pf.sys

windows7-x64

1

$SYSDIR/dr...pf.sys

windows10-2004-x64

1

$SYSDIR/pthreadVC.dll

windows7-x64

1

$SYSDIR/pthreadVC.dll

windows10-2004-x64

1

$SYSDIR/wpcap.dll

windows7-x64

1

$SYSDIR/wpcap.dll

windows10-2004-x64

1

$TEMP/WpBann.htm

windows7-x64

1

$TEMP/WpBann.htm

windows10-2004-x64

1

NetMonInstaller.exe

windows7-x64

1

NetMonInstaller.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    cb504432bd49f04733458353d0f79c48
  • Size 1.0MB
  • Sample240315-nrdwpafc6y
  • SHA256 50a8a27c3936baf64013435a27409f53abb3376327dbeef67aeadcfc89f70093
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
aspackv2

Malware Config

Targets

    • Target
      QQ.exe
    • Size 641KB
    • SHA256 303de9cac53782e258071adc3634d2955ffeb51ade600288b9d913c113e85172
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      QQ寻友大师使用说明.htm
    • Size 2KB
    • SHA256 2411ca9d8801ddb6e6157eb5785f7b92e335111756e141b011841fb2086524b1
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4
    • Target
      WinPcap_3_1.exe
    • Size 456KB
    • SHA256 cc3840c1b87fb73ce0f5612403d1fc0bbf192bde8639c81388133d80db59000d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/ExecDos.dll
    • Size 5KB
    • SHA256 b772c4d8112d1ff086ad4ba529cc802ff8f503d9003c9c73088a0240f4ba0523
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 12KB
    • SHA256 8203ae1589a50e6ff012e5d27bdd4f8ed7506077ca9b052827f5e90aaeb98519
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 12KB
    • SHA256 eb2aae4b1168d2cea71975ade37869988fab95346b8d4e8948dfa5b102f62f69
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/System.dll
    • Size 10KB
    • SHA256 7a24883bdbf08ce90938094b6ab6f09a842af10b18b8ae4d70da2e6b806490b8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/nsWeb.dll
    • Size 8KB
    • SHA256 7d4da7469d00e98f863b78caece3f2b753e26d7ce0ca9916c0802c35d7d22bcf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/nxs.dll
    • Size 5KB
    • SHA256 eaa72128b155796e0034ee58026dba9ba752ef9ccbbc80b7e628a3de31022cd5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      $SYSDIR/Packet.dll
    • Size 80KB
    • SHA256 19c6e6603021586092dcedf5592865cdda5cae1ee1db00343cdd523e399b0d65
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      $SYSDIR/WanPacket.dll
    • Size 60KB
    • SHA256 3064ea133646c4dbfbe750abbf836492a016b319783bc8166825e0783fd6e462
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      $SYSDIR/drivers/npf.sys
    • Size 31KB
    • SHA256 3694aa2145af617c47a7b506bd3d22824659ca3bf1680d220892cac4bd0fc846
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      $SYSDIR/pthreadVC.dll
    • Size 52KB
    • SHA256 99c61abf41c3aec38cab3ed6270adbca9a247bbf5f9aa9d29ecb0659a5527f48
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      $SYSDIR/wpcap.dll
    • Size 228KB
    • SHA256 ab1bf7740115d2930377a17e41d7f685acf51f128405dde228e492de6ce82725
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      $TEMP/WpBann.htm
    • Size 349B
    • SHA256 55a4936476920ff2b41ea0bbb0d8b993906bcf351d3a63f96808915d789a6c44
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral29behavioral30
    • Target
      NetMonInstaller.exe
    • Size 7KB
    • SHA256 b0898e33960664fd3d0409a2a1ad39d92cfdb1564d6532feac97ca428f8223e9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks