Overview
overview
9Static
static
9b6138bd31f...73.exe
windows7-x64
7b6138bd31f...73.exe
windows10-2004-x64
7$PLUGINSDIR/LogEx.dll
windows7-x64
3$PLUGINSDIR/LogEx.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3CrashReport.exe
windows7-x64
1CrashReport.exe
windows10-2004-x64
1InstallSys...ce.bat
windows7-x64
8InstallSys...ce.bat
windows10-2004-x64
8SystemClockHook.dll
windows7-x64
1SystemClockHook.dll
windows10-2004-x64
1SystemCloc...st.exe
windows7-x64
1SystemCloc...st.exe
windows10-2004-x64
1SystemCloc...64.exe
windows7-x64
6SystemCloc...64.exe
windows10-2004-x64
7SystemCloc...64.dll
windows7-x64
1SystemCloc...64.dll
windows10-2004-x64
1SystemTime...ce.exe
windows7-x64
1SystemTime...ce.exe
windows10-2004-x64
1UninstallS...ce.bat
windows7-x64
8UninstallS...ce.bat
windows10-2004-x64
8YXCalendar.exe
windows7-x64
6YXCalendar.exe
windows10-2004-x64
6YXCapture.dll
windows7-x64
1YXCapture.dll
windows10-2004-x64
1Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
12/06/2024, 04:33
Behavioral task
behavioral1
Sample
b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LogEx.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LogEx.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
CrashReport.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
CrashReport.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
InstallSystemTimeSyncService.bat
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
InstallSystemTimeSyncService.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
SystemClockHook.dll
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
SystemClockHook.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
SystemClockHookHost.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
SystemClockHookHost.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
SystemClockHookHost_x64.exe
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
SystemClockHookHost_x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
SystemClockHook_x64.dll
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
SystemClockHook_x64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
SystemTimeSyncService.exe
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
SystemTimeSyncService.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
UninstallSystemTimeSyncService.bat
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
UninstallSystemTimeSyncService.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
YXCalendar.exe
Resource
win7-20240419-en
Behavioral task
behavioral30
Sample
YXCalendar.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
YXCapture.dll
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
YXCapture.dll
Resource
win10v2004-20240226-en
General
- Target b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe
- Size 7.1MB
- Sample240612-e6wkls1cnp
- SHA256 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73
- MD5 be9a87d9ac301266af08218734ff4224
- SHA1 c46026f4015bed9ecf183be84c60c230b291a0db
- SHA512 7c8a31d0c92ec948f4788160b4233316746ae32adb0341f80f050c2abce4a23b6987f4123b6da5d5d51afb182bce662d694f434dee711732d9c780a0504035d4
- SSDEEP 196608:Qbf0n7QqLlUTuyTfcD4RmT5HdIFbyTu25SmF/5:QbG7Qq+h0YM9Mby/5Sm3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 1712 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe 1712 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe 1712 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe 1712 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1712 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe 1712 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe 1712 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe 1712 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1712 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe"C:\Users\Admin\AppData\Local\Temp\b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Users\Admin\AppData\Local\Temp\nsi284A.tmp\LogEx.dll
- Size 44KB
- SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
- MD5 0f96d9eb959ad4e8fd205e6d58cf01b8
- SHA1 7c45512cbdb24216afd23a9e8cdce0cfeaa7660f
- SHA512 9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c
- SSDEEP 384:w4NSXFjXCATBAQR4F1Y5u6I3wa4W7KNP66BjLjyXB0JyuDchv8EnohgSil2X:woaF+ATCQye/I3KWmxj00Jyb8Enov
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsi284A.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsi284A.tmp\nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsi284A.tmp\nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- MD5 SHA1 SHA512 SSDEEP