Overview
overview
7Static
static
3HSBC_UKToo....6.exe
windows10-1703-x64
6$PLUGINSDI...ns.dll
windows10-1703-x64
3$PLUGINSDI...LL.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...al.ini
windows10-1703-x64
1$PLUGINSDI...rd.bmp
windows10-1703-x64
4$SYSDIR/CF...SP.dll
windows10-1703-x64
3$SYSDIR/CF...PI.dll
windows10-1703-x64
1$SYSDIR/CF...IB.dll
windows10-1703-x64
3$SYSDIR/CF...11.dll
windows10-1703-x64
1$SYSDIR/CF...RV.exe
windows10-1703-x64
1$SYSDIR/CF...sp.dll
windows10-1703-x64
1$SYSDIR/CF...sp.sig
windows10-1703-x64
3$SYSDIR/Cr...BC.exe
windows10-1703-x64
7$PLUGINSDI...em.dll
windows10-1703-x64
3$SYSDIR/Cr...64.dll
windows10-1703-x64
7$SYSDIR/Cr...86.dll
windows10-1703-x64
1$SYSDIR/np...86.dll
windows10-1703-x64
3CryptoKitH...86.exe
windows10-1703-x64
1com.cfca.C...x.json
windows10-1703-x64
3com.cfca.C...n.json
windows10-1703-x64
3uninst.exe.nsis
windows10-1703-x64
3HSBC_UKeyTool.exe
windows10-1703-x64
1Analysis
-
max time kernel
510s -
max time network
512s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30/05/2024, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
HSBC_UKToolv1.0.0.6.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
$SYSDIR/CFCA_HSBC_CSP.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
$SYSDIR/CFCA_HSBC_GMAPI.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
$SYSDIR/CFCA_HSBC_LIB.dll
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
$SYSDIR/CFCA_HSBC_P11.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
$SYSDIR/CFCA_HSBC_SRV.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
$SYSDIR/CFCA_HSBC_scsp.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
$SYSDIR/CFCA_HSBC_scsp.sig
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
$SYSDIR/CryptoKit.HSBC.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
$SYSDIR/CryptoKit.HSBC.x64.dll
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
$SYSDIR/CryptoKit.HSBC.x86.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
$SYSDIR/npCryptoKit.HSBC.x86.dll
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
CryptoKitHost.HSBC.x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
com.cfca.CryptoKitHost.HSBC-firefox.json
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
com.cfca.CryptoKitHost.HSBC-win.json
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
uninst.exe.nsis
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
HSBC_UKeyTool.exe
Resource
win10-20240404-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
959ea64598b9a3e494c00e8fa793be7e
-
SHA1
40f284a3b92c2f04b1038def79579d4b3d066ee0
-
SHA256
03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
-
SHA512
5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
-
SSDEEP
192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3716 196 WerFault.exe 74 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4780 wrote to memory of 196 4780 rundll32.exe 74 PID 4780 wrote to memory of 196 4780 rundll32.exe 74 PID 4780 wrote to memory of 196 4780 rundll32.exe 74
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵PID:196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 196 -s 6283⤵
- Program crash
PID:3716
-
-