Overview
overview
7Static
static
7CoolIME.exe
windows7-x64
1CoolIME.exe
windows10-2004-x64
1Dicts/winp...in.vbs
windows7-x64
1Dicts/winp...in.vbs
windows10-2004-x64
1Dicts/winp...in.vbs
windows7-x64
1Dicts/winp...in.vbs
windows10-2004-x64
1Dicts/winput/User.ps1
windows7-x64
1Dicts/winput/User.ps1
windows10-2004-x64
1输入法教程.doc
windows7-x64
4输入法教程.doc
windows10-2004-x64
1酷极手册.chm
windows7-x64
1酷极手册.chm
windows10-2004-x64
1Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
15/03/2024, 14:55
Behavioral task
behavioral1
Sample
CoolIME.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
CoolIME.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Dicts/winput/PinYin.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
Dicts/winput/PinYin.vbs
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Dicts/winput/QuanPin.vbs
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral6
Sample
Dicts/winput/QuanPin.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Dicts/winput/User.ps1
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
Dicts/winput/User.ps1
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
输入法教程.doc
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
输入法教程.doc
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
酷极手册.chm
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
酷极手册.chm
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target CoolIME.exe
- Size 203KB
- Sample240315-saw36add24
- SHA256 f3d7ab474bdc4d5f3adc7cab63467aec6521a094743b2b2043164925b3f2a40b
- MD5 e2b61021ad14a95dd1a7442b6036ee70
- SHA1 1c674529e35e09eb7a1fb6cd5cbbfe6c103d449e
- SHA512 5753f02b85b8d576c9e3340e95e31f72bdd0b20a93a0e76d30365a24835d462ae1ded7c81228b184cc6ec05f1e52a8b01927fa2313691c21b4916850ffc9f3f4
- SSDEEP 3072:UEUkkn5/hZS0I/dorXcyTdxYtAaGOp3UrwSoKYeRT/5frjKC0NoUU2H+o23vNU:UEMrZSv6rNTUvp3UrBl/N8l
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 432 CoolIME.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe 432 CoolIME.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 432 CoolIME.exe