Overview
overview
10Static
static
7cfsamdsfzr...��.exe
windows7-x64
10cfsamdsfzr...��.exe
windows10-2004-x64
cfsamdsfzr...yg.dll
windows7-x64
10cfsamdsfzr...yg.dll
windows10-2004-x64
10cfsamdsfzr...��.exe
windows7-x64
7cfsamdsfzr...��.exe
windows10-2004-x64
7cfsamdsfzr...��.bat
windows7-x64
1cfsamdsfzr...��.bat
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 11:58
Behavioral task
behavioral1
Sample
cfsamdsfzrej_gr/LOL意哥破解版/LOL意哥全能辅助.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cfsamdsfzrej_gr/LOL意哥破解版/LOL意哥全能辅助.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
cfsamdsfzrej_gr/LOL意哥破解版/lolyg.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
cfsamdsfzrej_gr/LOL意哥破解版/lolyg.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
cfsamdsfzrej_gr/LOL意哥破解版/娇滴滴破解.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
cfsamdsfzrej_gr/LOL意哥破解版/娇滴滴破解.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
cfsamdsfzrej_gr/LOL意哥破解版/插件注册失败打开.bat
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
cfsamdsfzrej_gr/LOL意哥破解版/插件注册失败打开.bat
Resource
win10v2004-20240426-en
General
-
Target
cfsamdsfzrej_gr/LOL意哥破解版/娇滴滴破解.exe
-
Size
1.2MB
-
MD5
202efeb10f273ed71db018dd3b45c098
-
SHA1
b7c24e3e623c8d2f620ce190f87317efb58934a5
-
SHA256
03622c533b1c4e7c447eb8e5f3df62fe3dd22b6d8c9f674ff6ae3e145924b8b8
-
SHA512
9afaa6985ec3c422755e6403c353374a988b7fa058af68a27b94ae20030383f625d1ab4f2309eef517e362b2a937737aaca9740ee67600cd0e05fa42de8a9b02
-
SSDEEP
24576:HGqCMfDstdS2Tk+YPgsxfbP1mcm6fIyzUlr:HKMyS2JcgsBJmcOyzA
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral6/memory/1148-0-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-34-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-42-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-43-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-41-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-38-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-36-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-32-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-30-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-28-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-26-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-22-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-20-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-18-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-16-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-14-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-10-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-8-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-6-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-2-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-24-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-12-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-4-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-1-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx behavioral6/memory/1148-45-0x0000000000B20000-0x0000000000B5E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
娇滴滴破解.exepid process 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
娇滴滴破解.exepid process 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe 1148 娇滴滴破解.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfsamdsfzrej_gr\LOL意哥破解版\娇滴滴破解.exe"C:\Users\Admin\AppData\Local\Temp\cfsamdsfzrej_gr\LOL意哥破解版\娇滴滴破解.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1148
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:81⤵PID:4088