Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 01:27
General
-
Target
[ ChinaCheats ] CHSF Ver. 1.exe
-
Size
696KB
-
MD5
bbd5b72bc8c45038ae99d0eac2e1f50a
-
SHA1
f92725095591e94de437ffd119dbe4f8675e02b0
-
SHA256
fa054fbb991a5e3c9c56027e717f92639f5a37f7b9f0317c961365a9c5591996
-
SHA512
6b4925862652c09920503962d014830c4334592f1acb60b3387305c46dea7d339fdf580e09ce47533f526a3c498f259d2e7cc16c28c2cae50ee6563a06f86b30
-
SSDEEP
6144:/ONu5gAUuPKAF/KmgnL/EPGHDoc+HnuWkmZeHnTH8kNsUYOdv5SGt+QNpXa94vQD:m05jJZc/pZgGoENm4v0PY1nWV
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[ ChinaCheats ] CHSF Ver. 1.exe"C:\Users\Admin\AppData\Local\Temp\[ ChinaCheats ] CHSF Ver. 1.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[ ChinaCheats ] CHSF Ver. 1mgr.exe"C:\Users\Admin\AppData\Local\Temp\[ ChinaCheats ] CHSF Ver. 1mgr.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD5a767f197a9dab7a2caa273ffaeac4c3a
SHA12fa39063a7431d2bfd9e5ea65cf9ab6a3b4fdb23
SHA256a5d19b118cf998fb745d2f1f3cbe1bdef208ddd15aee2342de2d18c9c903dded
SHA512d5847f1202037bb98c983412117ae435ab1fdab0b96d4c1eb0be58e6e2c530a2b6d5f44736cd51a169486706d0bfe6ead0c1bcce7cec2ee8582436e70c367ced
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
1.3MB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
1.3MB
-
Filesize
1.3MB