Overview
overview
8Static
static
3AutoSnap.exe
windows7-x64
1AutoSnap.exe
windows10-2004-x64
1Client/DeskSide.exe
windows7-x64
1Client/DeskSide.exe
windows10-2004-x64
1Client/Des...��.url
windows7-x64
1Client/Des...��.url
windows10-2004-x64
1Client/FAKEDISK.sys
windows7-x64
1Client/FAKEDISK.sys
windows10-2004-x64
1Client/IMA...Ƭ.url
windows7-x64
1Client/IMA...Ƭ.url
windows10-2004-x64
1Client/InsFilt.exe
windows7-x64
8Client/InsFilt.exe
windows10-2004-x64
8Client/NUpdate.exe
windows7-x64
1Client/NUpdate.exe
windows10-2004-x64
1Client/NoClose.dll
windows7-x64
1Client/NoClose.dll
windows10-2004-x64
1Client/SEBarClt.exe
windows7-x64
6Client/SEBarClt.exe
windows10-2004-x64
6Client/SEBarVD.dll
windows7-x64
6Client/SEBarVD.dll
windows10-2004-x64
6Client/SEIEBho.dll
windows7-x64
6Client/SEIEBho.dll
windows10-2004-x64
6Client/SExpMenu.exe
windows7-x64
3Client/SExpMenu.exe
windows10-2004-x64
3Client/SyncExp.exe
windows7-x64
1Client/SyncExp.exe
windows10-2004-x64
1Client/SyncExpSim.exe
windows7-x64
6Client/SyncExpSim.exe
windows10-2004-x64
6Client/board.rtf
windows7-x64
4Client/board.rtf
windows10-2004-x64
1Client/nQMailer.exe
windows7-x64
5Client/nQMailer.exe
windows10-2004-x64
5Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:39
Static task
static1
Behavioral task
behavioral1
Sample
AutoSnap.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
AutoSnap.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Client/DeskSide.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Client/DeskSide.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Client/DeskSideù.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Client/DeskSideù.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Client/FAKEDISK.sys
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
Client/FAKEDISK.sys
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Client/IMAGES/ͼƬ.url
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
Client/IMAGES/ͼƬ.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Client/InsFilt.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Client/InsFilt.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Client/NUpdate.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Client/NUpdate.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Client/NoClose.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Client/NoClose.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
Client/SEBarClt.exe
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
Client/SEBarClt.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Client/SEBarVD.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Client/SEBarVD.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Client/SEIEBho.dll
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
Client/SEIEBho.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Client/SExpMenu.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Client/SExpMenu.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Client/SyncExp.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Client/SyncExp.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Client/SyncExpSim.exe
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
Client/SyncExpSim.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Client/board.rtf
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
Client/board.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
Client/nQMailer.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Client/nQMailer.exe
Resource
win10v2004-20240508-en
General
-
Target
Client/SyncExp.exe
-
Size
1.1MB
-
MD5
874f885300027c7e24d02fbd48efbe7d
-
SHA1
f40a7e4db43f754f274010a9b2fc4bb3d03b4917
-
SHA256
a64f136fafc9dde40caf995aa6558e2e2cdbce11665066438183782ce6d8fa3b
-
SHA512
99a5b0c7d3b17ae279e3d797626a44f553ab76f2f6201f9a929fc5237cf690ba87369fc4d4611a544eb5334c28ea8987d360e2bcc1c40e3fcc03913ea953a273
-
SSDEEP
24576:G43aSrUtq6fS3alSTnC/vRTWKOqhj4If/rvCvI:G43apM6JKn6Fh4If2I
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SyncExp.exedescription pid process Token: 33 4564 SyncExp.exe Token: SeIncBasePriorityPrivilege 4564 SyncExp.exe