Overview
overview
5Static
static
3de126ef0de...c1.exe
windows7-x64
3de126ef0de...c1.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$SYSDIR/Te...ll.htm
windows7-x64
1$SYSDIR/Te...ll.htm
windows10-2004-x64
1$SYSDIR/bakrdgv3.exe
windows7-x64
1$SYSDIR/bakrdgv3.exe
windows10-2004-x64
1$SYSDIR/bakstec3.exe
windows7-x64
5$SYSDIR/bakstec3.exe
windows10-2004-x64
5$SYSDIR/kq...x.html
windows7-x64
1$SYSDIR/kq...x.html
windows10-2004-x64
1$SYSDIR/kq...x.html
windows7-x64
1$SYSDIR/kq...x.html
windows10-2004-x64
1$SYSDIR/ni...min.js
windows7-x64
3$SYSDIR/ni...min.js
windows10-2004-x64
3$SYSDIR/ni...bar.js
windows7-x64
3$SYSDIR/ni...bar.js
windows10-2004-x64
3$SYSDIR/pl...le.dll
windows7-x64
1$SYSDIR/pl...le.dll
windows10-2004-x64
1$SYSDIR/pl...er.dll
windows7-x64
1$SYSDIR/pl...er.dll
windows10-2004-x64
1$SYSDIR/pl...63.dll
windows7-x64
1$SYSDIR/pl...63.dll
windows10-2004-x64
1$SYSDIR/po...x.html
windows7-x64
1$SYSDIR/po...x.html
windows10-2004-x64
1$SYSDIR/winoav3.dll
windows7-x64
1$SYSDIR/winoav3.dll
windows10-2004-x64
1Analysis
- max time kernel
91s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 04:21
Behavioral task
behavioral1
Sample
de126ef0de8b4498f0297839f82d659ba585621b6175508c437e8f41a49e25c1.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
de126ef0de8b4498f0297839f82d659ba585621b6175508c437e8f41a49e25c1.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$SYSDIR/Template/RedCell.htm
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral10
Sample
$SYSDIR/Template/RedCell.htm
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$SYSDIR/bakrdgv3.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral12
Sample
$SYSDIR/bakrdgv3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$SYSDIR/bakstec3.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
$SYSDIR/bakstec3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$SYSDIR/kquickpop/tr_win7_lb_inst2/index.html
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral16
Sample
$SYSDIR/kquickpop/tr_win7_lb_inst2/index.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$SYSDIR/kquickpop/up3rd_rcmdlbinst/index.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
$SYSDIR/kquickpop/up3rd_rcmdlbinst/index.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$SYSDIR/nicdrvhelp/js/jquery-1.7.1.min.js
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral20
Sample
$SYSDIR/nicdrvhelp/js/jquery-1.7.1.min.js
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$SYSDIR/nicdrvhelp/js/jquery.tinyscrollbar.js
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral22
Sample
$SYSDIR/nicdrvhelp/js/jquery.tinyscrollbar.js
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$SYSDIR/plugins/example.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
$SYSDIR/plugins/example.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$SYSDIR/plugins/ipchanger.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
$SYSDIR/plugins/ipchanger.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$SYSDIR/plugins/mx_163.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
$SYSDIR/plugins/mx_163.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$SYSDIR/popup/deskshorthint/index.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral30
Sample
$SYSDIR/popup/deskshorthint/index.html
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$SYSDIR/winoav3.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral32
Sample
$SYSDIR/winoav3.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target de126ef0de8b4498f0297839f82d659ba585621b6175508c437e8f41a49e25c1.exe
- Size 10.8MB
- Sample240509-eyzbjadc43
- SHA256 de126ef0de8b4498f0297839f82d659ba585621b6175508c437e8f41a49e25c1
- MD5 9b5b91e24f21819934dc9a9551ff5c93
- SHA1 17c913126039d93dcc3bd487cc6b2ac504a25f9a
- SHA512 1ed156003e9fee9d1a3f3774220555adb0409293076694ab20d79efbd46dc5fdd25358c91231619b6e8023d5acdaf4c133fc2974dfe38e84ee7938648a36b209
- SSDEEP 196608:fGzA+9CZKfpCZGhOqhI8HuAUZ567e1fzvLXvHfoJQKA6nw:f7+9dAIMqhI8fU367e1f/Hfs5A6nw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 4980 2788 WerFault.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\de126ef0de8b4498f0297839f82d659ba585621b6175508c437e8f41a49e25c1.exe"C:\Users\Admin\AppData\Local\Temp\de126ef0de8b4498f0297839f82d659ba585621b6175508c437e8f41a49e25c1.exe"1⤵PID:2788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 4122⤵
- Program crash
PID:4980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2788 -ip 27881⤵PID:4848