Overview

overview

9

Static

static

9

Haozhuodao...ta.exe

windows7-x64

7

Haozhuodao...ta.exe

windows10-2004-x64

7

$APPDATA/H...at.exe

windows7-x64

1

$APPDATA/H...at.exe

windows10-2004-x64

1

$APPDATA/H...nf.exe

windows7-x64

1

$APPDATA/H...nf.exe

windows10-2004-x64

1

$APPDATA/H...e3.dll

windows7-x64

3

$APPDATA/H...e3.dll

windows10-2004-x64

3

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

3

$PLUGINSDI...on.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...rk.dll

windows7-x64

1

$PLUGINSDI...rk.dll

windows10-2004-x64

1

$TEMP/QQPh...28.exe

windows7-x64

1

$TEMP/QQPh...28.exe

windows10-2004-x64

1

$TEMP/SU_l...97.exe

windows7-x64

7

$TEMP/SU_l...97.exe

windows10-2004-x64

7

$TEMP/setup_3126.exe

windows7-x64

1

$TEMP/setup_3126.exe

windows10-2004-x64

1

ContextBG.dll

windows7-x64

1

ContextBG.dll

windows10-2004-x64

1

HZDApp.exe

windows7-x64

1

HZDApp.exe

windows10-2004-x64

1

HZDHelper.exe

windows7-x64

1

HZDHelper.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 20:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Haozhuodao_V3.4.17.417_Beta.exe

  • Size

    13.6MB

  • MD5

    0f6160718324775d1394ccfa4b5eff7a

  • SHA1

    0c221fd655414edc934c9c29c48ca4ae4a45fa18

  • SHA256

    60aedd194ccc5cc9493dc2584c05eca1f86ba1218a31d86c3708726f9092d090

  • SHA512

    45f97108996874fa3dbfdf216769c4c216c2c5991532f523b3b6d0e55684a41ff0e808b68578a8c020a78470bc4851f43281ee052bbeaa4fd8d0a5c77d1b17fe

  • SSDEEP

    196608:nQjYN4uypiR2Go4fmAvh0eIstP/2CtjSzLgNd9Vu/GTXgucG4YqBP2+9AazXv+gL:QjYGuKiAK9eezt/39VTwuy2+HVWO1V1

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Haozhuodao_V3.4.17.417_Beta.exe
    "C:\Users\Admin\AppData\Local\Temp\Haozhuodao_V3.4.17.417_Beta.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:4504

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsk47D7.tmp\BrandingURL.dll
    Filesize

    4KB

    MD5

    71c46b663baa92ad941388d082af97e7

    SHA1

    5a9fcce065366a526d75cc5ded9aade7cadd6421

    SHA256

    bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

    SHA512

    5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsk47D7.tmp\GetVersion.dll
    Filesize

    5KB

    MD5

    2e2412281a205ed8d53aafb3ef770a2d

    SHA1

    3cae4138e8226866236cf34f8fb00dafb0954d97

    SHA256

    db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

    SHA512

    6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsk47D7.tmp\InstallOptions.dll
    Filesize

    14KB

    MD5

    0dc0cc7a6d9db685bf05a7e5f3ea4781

    SHA1

    5d8b6268eeec9d8d904bc9d988a4b588b392213f

    SHA256

    8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    SHA512

    814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsk47D7.tmp\System.dll
    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsk47D7.tmp\ioSpecial.ini
    Filesize

    593B

    MD5

    bb230ad5b023879c96ff8f62b7d30caf

    SHA1

    928a8e6bc633e9fe7f75dbb2bff50690ac9cabd5

    SHA256

    ac3391d766dc2bccbc4905f7cf75f1d38b0fc9c22d92b39df59c34bd1e733444

    SHA512

    5b8a5f2d7c4a32ec2c80d02f927581a5480fbc5d2db8fbb3a5acbfefb6f5d801fcf7b667ce2ebab2217aa6fc007a940a9a9e60f6e383631cf81e85a3447afcc8

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsk47D7.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit
  • memory/4504-15-0x00000000022C0000-0x0000000002301000-memory.dmp
    Filesize

    260KB

    Download