Overview
overview
7Static
static
7LingvoSoft...l).exe
windows7-x64
7LingvoSoft...l).exe
windows10-2004-x64
7$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$WINDIR/ls...py.cmd
windows7-x64
1$WINDIR/ls...py.cmd
windows10-2004-x64
1LingvoSoft...ol.htm
windows7-x64
1LingvoSoft...ol.htm
windows10-2004-x64
1LingvoSoft...re.htm
windows7-x64
1LingvoSoft...re.htm
windows10-2004-x64
1LingvoSoft...er.htm
windows7-x64
1LingvoSoft...er.htm
windows10-2004-x64
1LingvoSoft...us.htm
windows7-x64
1LingvoSoft...us.htm
windows10-2004-x64
1LingvoSoft...pa.htm
windows7-x64
1LingvoSoft...pa.htm
windows10-2004-x64
1LingvoSoft...as.htm
windows7-x64
1LingvoSoft...as.htm
windows10-2004-x64
1LingvoSoft...re.htm
windows7-x64
1LingvoSoft...re.htm
windows10-2004-x64
1LingvoSoft...er.htm
windows7-x64
1LingvoSoft...er.htm
windows10-2004-x64
1LingvoSoft...us.htm
windows7-x64
1LingvoSoft...us.htm
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 12:33
Behavioral task
behavioral1
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional)/Chinese (Traditional).exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional)/Chinese (Traditional).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AdvSplash.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AdvSplash.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$WINDIR/ls-rkf-copy.cmd
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$WINDIR/ls-rkf-copy.cmd
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school.htm
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school_fre.htm
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school_fre.htm
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school_ger.htm
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school_ger.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school_rus.htm
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school_rus.htm
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school_spa.htm
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_back2school_spa.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_christmas.htm
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_christmas.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_christmas_fre.htm
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_christmas_fre.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_christmas_ger.htm
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_christmas_ger.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_christmas_rus.htm
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional) for Windows/Advert/ld_christmas_rus.htm
Resource
win10v2004-20240426-en
General
- Target LingvoSoft Talking Dictionary 2008 (English-Chinese Traditional)/Chinese (Traditional).exe
- Size 4.2MB
- Sample240603-prp5dsfh34
- SHA256 68c961fa8e25cf6f564fe9f08390eae10013ca23546c90bc9fd7bb9fb37d9cf3
- MD5 a3492e92714b49ec5e7002b2ecc37e9c
- SHA1 63877148dce67adba29dfb79a4db225c2ebb8e11
- SHA512 2858ba547080ef5400c5c1b4678de9b187b39be012715d60137c8c835257897c1f1b513fade70480eabbaec852eab3dab7fadc85bdfe04da378d06a770b51c5d
- SSDEEP 98304:fpPMTb2DZdVhNJG77KG2tPF37TCjnTBKqQDhdmc4/z5ta2:fpkG1d3+7DqPFrTCjT0M//z5p
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 7 IoCs
pid Process 1700 Chinese (Traditional).exe 1700 Chinese (Traditional).exe 1700 Chinese (Traditional).exe 1700 Chinese (Traditional).exe 1700 Chinese (Traditional).exe 1700 Chinese (Traditional).exe 1700 Chinese (Traditional).exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsm574A.tmp\AdvSplash.dll
- Size 6KB
- SHA256 cededcb856f634d96f6a52ebfad5f0a7992160bd59e56b4fcb29a4d8dded4b52
- MD5 c2b0653b5c96f8c9a0d07d157739006d
- SHA1 026734bde377a73bc70815ec71225f3025ddba80
- SHA512 293e9badf2f960c0e1ad82920061977dcfd7ba470918d0ac659f2446783306268410a7de9eb03c78c4a6e44f62c521c83b4335c7474bfe47ea8321fe801af2fc
- SSDEEP 96:0QNyX2PtUZsMGe3SlFaqqhN51xWa5kkEkk/StCVwookyc:0FXYtxWSf61vk/kkStCVRt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsm574A.tmp\BgImage.dll
- Size 7KB
- SHA256 0fa63770dcffdd96abce6f29f47356d7cd2294b5da33bb709a567368b3bb0ae9
- MD5 8ef133159dacbae0af1df462947380d9
- SHA1 35cb496273f5f5bd106e56f5da5964fac9df8352
- SHA512 8280131d6e65eb79b2621269113a845a27decde1fbc2ea5a72c6416ea9285c768fdd167c961e5889754d2d6a97105b1c91f97234af4520b3a80c98b45bcc7363
- SSDEEP 96:LcuJQGDD6lKsLcLGRpHZwlkxYWaSsZL5JR3n1zDUsc:gumGDD6BgLGR4ZLjB1Usc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsm574A.tmp\InstallOptions.dll
- Size 14KB
- SHA256 747d0222b652dbfc85e0de4f8486473662d325a55e32c7eacb91e53e37ceba58
- MD5 b18dfaded8f6d2380fdfd8f6b6969211
- SHA1 969fa0e906240ab1123254feeb833c275626cf76
- SHA512 25fb09b8657997d31e61c908f1cd08357c1a1b68bbb1ba377e87b6a3eb347a2ef96c1a771b6c4332853abb33728c55c83efa73df5da03f3dfc132f8a69a2886c
- SSDEEP 192:66JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTLK72dwF7dBdcQOz:66JaVh4I5rpPbTL+BdhO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsm574A.tmp\LangDLL.dll
- Size 5KB
- SHA256 e54792a179a06acbb9b69c117ee804dce070505d1853d6e7d512f2a055a801b2
- MD5 9b17a13f814b137f88b961c087858063
- SHA1 c290dd3139b79aa340aec3ed3d674160433035e1
- SHA512 3a625f5f13e344c24973c79c074d1ced4d9206f87f392dc7c8f0c116d0f2b878b60340e2377d0240c47f0e34e25e4e3af8b196bbca1c6a29a0f51d8408e8b0ec
- SSDEEP 48:SnNQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJcABofgMGKO:Bz+MM4eqmvz0JScx56mpwzAhWcGV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsm574A.tmp\UserInfo.dll
- Size 4KB
- SHA256 9ef619bef78d71437d2d332244b405f7dec82a11c8e5917bcbb182b91fdad5c2
- MD5 d9bfc172ffb915cb6e07759674844993
- SHA1 42775b7eacb8c24c82aa496bf6b42b8e60c94b53
- SHA512 846e5cb7f45d1d1ac41c150823daaf2299730ec347b5c5e640250953ec88df3c63005cb835a708ef940777d8cbeb3a97b252db9e627fd87245a115c20b670735
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsm574A.tmp\ioSpecial.ini
- Size 820B
- SHA256 e88cbfe2167f44c66f7d1dd78830de7cbb273c4f4db06f69e692775ea79c7224
- MD5 b0a9c3f1c0e0546e6e1647db4cea4971
- SHA1 1057c4c96e4431367d07607fa8a8c98a8c7eba1c
- SHA512 94158ff4d4633aae389339e254a4fef017bf30bd6b504167c77473ab4ef49ec855c8af17d1e6e4367ce515b577520e53e9dc15154f508a2e27b9af6eb7263c39
- MD5 SHA1 SHA512