f6de40a0e0c5b51daa70456189d10f7fc1e7dcd36168cf8afcb17035efda6686 | Triage

Submit
Reports

Overview

overview

Static

static

WeChatSetup.exe

windows7-x64

4

WeChatSetup.exe

windows10-2004-x64

4

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

1

$PLUGINSDI...ll.dll

windows10-2004-x64

1

$PLUGINSDI...st.dll

windows7-x64

3

$PLUGINSDI...st.dll

windows10-2004-x64

3

Uninstall.exe

windows7-x64

4

Uninstall.exe

windows10-2004-x64

4

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

1

$PLUGINSDI...ll.dll

windows10-2004-x64

1

WeChat.exe

windows7-x64

WeChat.exe

windows10-2004-x64

WechatAppLauncher.exe

windows7-x64

1

WechatAppLauncher.exe

windows10-2004-x64

1

[3.9.9.43]...dk.dll

windows7-x64

1

[3.9.9.43]...dk.dll

windows10-2004-x64

1

host/wmpf_...rt.dll

windows7-x64

1

host/wmpf_...rt.dll

windows10-2004-x64

1

host/wmpf_...64.dll

windows7-x64

1

host/wmpf_...64.dll

windows10-2004-x64

1

runtime/Co...on.dll

windows7-x64

1

runtime/Co...on.dll

windows10-2004-x64

1

runtime/ConfSdk.dll

windows7-x64

1

runtime/ConfSdk.dll

windows10-2004-x64

1

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 10:26

Sharing

Static task

static1

vmprotect meduza

4 signatures

Behavioral task

behavioral1

Sample

WeChatSetup.exe

Resource

win7-20240221-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

WeChatSetup.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/FindProcDLL.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/FindProcDLL.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/WeChatInstallDll.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/WeChatInstallDll.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/nsInstallAssist.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/nsInstallAssist.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

Uninstall.exe

Resource

win7-20240221-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral12

Sample

Uninstall.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral13

Sample

$PLUGINSDIR/FindProcDLL.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

$PLUGINSDIR/FindProcDLL.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

$PLUGINSDIR/System.dll

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

$PLUGINSDIR/WeChatInstallDll.dll

Resource

win7-20240220-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

$PLUGINSDIR/WeChatInstallDll.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

WeChat.exe

Resource

win7-20240221-en

meduza evasion stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral20

Sample

WeChat.exe

Resource

win10v2004-20240226-en

meduza evasion stealer

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral21

Sample

WechatAppLauncher.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

WechatAppLauncher.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

[3.9.9.43]/ConfSdk.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

[3.9.9.43]/ConfSdk.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

host/wmpf_host_export.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

host/wmpf_host_export.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

host/wmpf_host_export_x64.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

host/wmpf_host_export_x64.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

runtime/ComponentVerification.dll

Resource

win7-20240215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

runtime/ComponentVerification.dll

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

runtime/ConfSdk.dll

Resource

win7-20240220-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

runtime/ConfSdk.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

runtime/ConfSdk.dll
Size

1.2MB
MD5

c21a0198c2c75b325b8fd1233ba6984e
SHA1

fc0442083b7c165b97efb8018cffa0c78ac50a8c
SHA256

f9c904746a447a25f2e7815448e69a5c29dd2c207962df208916d3e52e2ae888
SHA512

d34a74715ef8c86b05b8802882a77265d71249f00fa4e9b850322465747fda2fce8e6a56bd1aed3ec99ef5957cb192e487f51fb0c575bc07fc7b532e783be0e3
SSDEEP

24576:ND9Yx6VsUPUN3onEeV47fI+jF5Sw9Y3Cj+j+xb:NKgwagQMF5Sf3oL

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\runtime\ConfSdk.dll,#1
1⤵
PID:4424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2024

Terms | Privacy