Overview
overview
7Static
static
3HSBC_UKToo....6.exe
windows10-1703-x64
6$PLUGINSDI...ns.dll
windows10-1703-x64
3$PLUGINSDI...LL.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...al.ini
windows10-1703-x64
1$PLUGINSDI...rd.bmp
windows10-1703-x64
4$SYSDIR/CF...SP.dll
windows10-1703-x64
3$SYSDIR/CF...PI.dll
windows10-1703-x64
1$SYSDIR/CF...IB.dll
windows10-1703-x64
3$SYSDIR/CF...11.dll
windows10-1703-x64
1$SYSDIR/CF...RV.exe
windows10-1703-x64
1$SYSDIR/CF...sp.dll
windows10-1703-x64
1$SYSDIR/CF...sp.sig
windows10-1703-x64
3$SYSDIR/Cr...BC.exe
windows10-1703-x64
7$PLUGINSDI...em.dll
windows10-1703-x64
3$SYSDIR/Cr...64.dll
windows10-1703-x64
7$SYSDIR/Cr...86.dll
windows10-1703-x64
1$SYSDIR/np...86.dll
windows10-1703-x64
3CryptoKitH...86.exe
windows10-1703-x64
1com.cfca.C...x.json
windows10-1703-x64
3com.cfca.C...n.json
windows10-1703-x64
3uninst.exe.nsis
windows10-1703-x64
3HSBC_UKeyTool.exe
windows10-1703-x64
1Analysis
-
max time kernel
315s -
max time network
377s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30/05/2024, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
HSBC_UKToolv1.0.0.6.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
$SYSDIR/CFCA_HSBC_CSP.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
$SYSDIR/CFCA_HSBC_GMAPI.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
$SYSDIR/CFCA_HSBC_LIB.dll
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
$SYSDIR/CFCA_HSBC_P11.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
$SYSDIR/CFCA_HSBC_SRV.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
$SYSDIR/CFCA_HSBC_scsp.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
$SYSDIR/CFCA_HSBC_scsp.sig
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
$SYSDIR/CryptoKit.HSBC.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
$SYSDIR/CryptoKit.HSBC.x64.dll
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
$SYSDIR/CryptoKit.HSBC.x86.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
$SYSDIR/npCryptoKit.HSBC.x86.dll
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
CryptoKitHost.HSBC.x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
com.cfca.CryptoKitHost.HSBC-firefox.json
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
com.cfca.CryptoKitHost.HSBC-win.json
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
uninst.exe.nsis
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
HSBC_UKeyTool.exe
Resource
win10-20240404-en
General
-
Target
$SYSDIR/npCryptoKit.HSBC.x86.dll
-
Size
1.1MB
-
MD5
48eb627ddb83642dd4848e2c08d68d80
-
SHA1
1f9ec3811f68f65c17719cf5ccb2a81a38672fc1
-
SHA256
5a52680b20a7b2ca26383f83ad4285b9f236f765cfcdcdb0f11a8ee14696d3a9
-
SHA512
a1a8fc58c7633f7d868863827e34d1d15bf04e62cd166f91c89e23db463b90c3264474d57cac28b387113505c1925e8d5d3ed51bada307bedb4b3a107790d07e
-
SSDEEP
24576:ggIUf+v7BrAPaOLnc5xaVlanYJofo2XLk:UISO4mlRJmoYLk
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2632 1368 WerFault.exe 73 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4948 wrote to memory of 1368 4948 rundll32.exe 73 PID 4948 wrote to memory of 1368 4948 rundll32.exe 73 PID 4948 wrote to memory of 1368 4948 rundll32.exe 73
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\npCryptoKit.HSBC.x86.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\npCryptoKit.HSBC.x86.dll,#12⤵PID:1368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 6483⤵
- Program crash
PID:2632
-
-