Overview
overview
5Static
static
3病毒样�...ts.exe
windows7-x64
1病毒样�...ts.exe
windows10-2004-x64
1病毒样�...rl.exe
windows7-x64
1病毒样�...rl.exe
windows10-2004-x64
1病毒样�...lx.exe
windows7-x64
1病毒样�...lx.exe
windows10-2004-x64
1病毒样�...3a.exe
windows7-x64
5病毒样�...3a.exe
windows10-2004-x64
5病毒样�...rv.exe
windows7-x64
1病毒样�...rv.exe
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 09:08
Static task
static1
Behavioral task
behavioral1
Sample
病毒样本/Windows MailX/1.0.0.0/winhts.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
病毒样本/Windows MailX/1.0.0.0/winhts.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
病毒样本/Windows MailX/1.0.0.0/zcurl.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
病毒样本/Windows MailX/1.0.0.0/zcurl.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
病毒样本/Windows MailX/mailx.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
病毒样本/Windows MailX/mailx.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
病毒样本/b267-53a.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
病毒样本/b267-53a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
病毒样本/zserv/zserv.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
病毒样本/zserv/zserv.exe
Resource
win10v2004-20240426-en
General
-
Target
病毒样本/Windows MailX/1.0.0.0/winhts.exe
-
Size
1.7MB
-
MD5
e21750740f1dfe2e86d29d7cf712131d
-
SHA1
5a740c50146b1e2d7e72d2fe1f5854d94499d9c6
-
SHA256
49f95cfb92a782b99b9c5b20a86b2363faa739124a89791a56c116729fb2a1e8
-
SHA512
bf9ebff7b071c1ec2dce48381e14f4444aab8f57243ac229c9e411d6f8a110cf697c19b367ab62c694cfb201341e05ee052ba7b2ea7b98801a660e4e1b3ca5d5
-
SSDEEP
49152:y5bf8JrkktU1ZpGEWwD7uQaPiyd2yglP:yZf8JA2U5GEFD71
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 3044 2180 winhts.exe 29 PID 2180 wrote to memory of 3044 2180 winhts.exe 29 PID 2180 wrote to memory of 3044 2180 winhts.exe 29 PID 2180 wrote to memory of 3044 2180 winhts.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\病毒样本\Windows MailX\1.0.0.0\winhts.exe"C:\Users\Admin\AppData\Local\Temp\病毒样本\Windows MailX\1.0.0.0\winhts.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\病毒样本\Windows MailX\1.0.0.0\SrTasksa.datSrTasksa.dat hidden2⤵PID:3044
-