1638a9d7a5e687d96a71c29e46773afd2a4e1417ff436d2c17cbe081251d228f

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

晨宝机甲旋风辅助V6.4[稳定功能].exe
Size

1.5MB
MD5

566435d98e1aab33b54e3ea0a1b39123
SHA1

869d7dee81a11256247ece983c9d429d85fd575c
SHA256

a270b3d10167384b44b1d4096e3194bb3080ca1398b61d095cf900b9cca04706
SHA512

525ef49b6eb894a68699385422514335639b398334a601efe8c1ef6ccef9907cdc5b7469ed735dd82220ab85f1bdc901b42fe4aea731806225ba4bfe5fe845e3
SSDEEP

24576:SE6aZhcJyfLxh9fsFOksQlE/D0o5J6Z1ZylvekSFYyP4M2cEiej21ZWhtrg/9igh:SE68mJyfLxssQGzJEA9+PR2cEC1ZWbow

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral3/files/0x000b000000015ca5-2.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2568	service_9008.exe

Loads dropped DLL 2 IoCs

pid	Process
2196	晨宝机甲旋风辅助V6.4[稳定功能].exe
2196	晨宝机甲旋风辅助V6.4[稳定功能].exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2196-0-0x0000000000400000-0x000000000075E000-memory.dmp	upx
behavioral3/files/0x000b000000015ca5-2.dat	upx
behavioral3/memory/2196-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral3/memory/2196-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral3/memory/2196-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral3/memory/2196-34-0x0000000000400000-0x000000000075E000-memory.dmp	upx

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?kwczangsq"	晨宝机甲旋风辅助V6.4[稳定功能].exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	晨宝机甲旋风辅助V6.4[稳定功能].exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2196	晨宝机甲旋风辅助V6.4[稳定功能].exe
2196	晨宝机甲旋风辅助V6.4[稳定功能].exe
2196	晨宝机甲旋风辅助V6.4[稳定功能].exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2568	2196	晨宝机甲旋风辅助V6.4[稳定功能].exe	28
PID 2196 wrote to memory of 2568	2196	晨宝机甲旋风辅助V6.4[稳定功能].exe	28
PID 2196 wrote to memory of 2568	2196	晨宝机甲旋风辅助V6.4[稳定功能].exe	28
PID 2196 wrote to memory of 2568	2196	晨宝机甲旋风辅助V6.4[稳定功能].exe	28

C:\Users\Admin\AppData\Local\Temp\晨宝机甲旋风辅助V6.4[稳定功能].exe
"C:\Users\Admin\AppData\Local\Temp\晨宝机甲旋风辅助V6.4[稳定功能].exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\service_9008.exe
  C:\Users\Admin\AppData\Local\Temp\service_9008.exe
  2⤵
  - Executes dropped EXE
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\jedata.dll

Filesize
86KB

MD5
114054313070472cd1a6d7d28f7c5002

SHA1
9a044986e6101df1a126035da7326a50c3fe9a23

SHA256
e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

SHA512
a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

Download Submit
\Users\Admin\AppData\Local\Temp\service_9008.exe

Filesize
662KB

MD5
11f70db030138b8fce385ef36448be5d

SHA1
37965dcefac7f352713f0d3d1d1f576370e1a848

SHA256
c2137c53fb23b158495f61dac9424fe760f415072d2a4a2690aa6c5c38656ed8

SHA512
01990032e75a7762859879fb39953d9b05137704a59ffe39fa30d43ae98fdea1295dcaf06a31cb8cc6f320bae335e4e0832af9477c448311a43d83c6919be3bb

Download Submit
memory/2196-0-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/2196-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2196-6-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/2196-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2196-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2196-34-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/2568-14-0x0000000037490000-0x00000000374A0000-memory.dmp

Filesize
64KB

Download
memory/2568-15-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2568-38-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download