Overview
overview
6Static
static
3qqkeybord1/Deamon.exe
windows7-x64
1qqkeybord1/Deamon.exe
windows10-2004-x64
1qqkeybord1/Defend.exe
windows7-x64
1qqkeybord1/Defend.exe
windows10-2004-x64
1qqkeybord1/Hook.dll
windows7-x64
1qqkeybord1/Hook.dll
windows10-2004-x64
1qqkeybord1...py.exe
windows7-x64
6qqkeybord1...py.exe
windows10-2004-x64
6下载说明.html
windows7-x64
1下载说明.html
windows10-2004-x64
1Analysis
-
max time kernel
51s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
qqkeybord1/Deamon.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
qqkeybord1/Deamon.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
qqkeybord1/Defend.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
qqkeybord1/Defend.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
qqkeybord1/Hook.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
qqkeybord1/Hook.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
qqkeybord1/KeyboardSpy.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
qqkeybord1/KeyboardSpy.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
下载说明.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
下载说明.html
Resource
win10v2004-20240508-en
General
-
Target
qqkeybord1/Hook.dll
-
Size
56KB
-
MD5
60e4120b17760f59952b70a87da9d57d
-
SHA1
a58081f8164bb9d6e1e9823772da85c66bc4920e
-
SHA256
43f98491a8e705326b60e96937d591416930c0347680e905852e2436c8709dcb
-
SHA512
db2aee556f83dbd1999daea78ee5884598643d958d0a83dc1297b431d453495da5631dbf052816813c4f5d952c0010beb0e4a24d3dcc63d0d6d2ac937d26807b
-
SSDEEP
384:1QP0P//K9Wsd+/kto2EDCSqgpPJPKj/JcCcgONER+WxgqClRgVA3RTJr4UgIeupK:68P/nsP/gGjyCENggqClRgAziZ1tVt3
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 372 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4908 wrote to memory of 372 4908 rundll32.exe 81 PID 4908 wrote to memory of 372 4908 rundll32.exe 81 PID 4908 wrote to memory of 372 4908 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\qqkeybord1\Hook.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\qqkeybord1\Hook.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:372
-