Overview
overview
6Static
static
3fck.exe
windows7-x64
1fck.exe
windows10-2004-x64
1findcheck.dll
windows7-x64
1findcheck.dll
windows10-2004-x64
1findcheckb.dll
windows7-x64
6findcheckb.dll
windows10-2004-x64
6findchecke.exe
windows7-x64
6findchecke.exe
windows10-2004-x64
6uninstall.exe
windows7-x64
1uninstall.exe
windows10-2004-x64
1Analysis
- max time kernel
145s - max time network
119s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
21/06/2024, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
fck.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
fck.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
findcheck.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
findcheck.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
findcheckb.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
findcheckb.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
findchecke.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
findchecke.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
uninstall.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
uninstall.exe
Resource
win10v2004-20240508-en
General
- Target findchecke.exe
- Size 1013KB
- Sample240621-qf3rsa1dkd
- SHA256 ea168ab72fc6d5ff05057d4a12dbf88dd38d59d2b8d1b91b38f9f4728dcb549a
- MD5 b82cf52780f79f6ad3cc7965b980a4d0
- SHA1 40f16c23f8913e0d4aea0d18592e4e78c3d67b88
- SHA512 173df09772af61235b7a245c7b3a78d5b6a8ccfa34b32c822e8764044b3ef241f62af3b0dbdd12bfcd42647bd014242c4ea962d3ffff4729d6d8e632e14d019e
- SSDEEP 12288:oQYVGXlKfjwRE+NyYq2xf2gQCdgZBbbAU98msUqDVepRQ0R7Fav2mMzFa4cQZ:hum9/AhLgQ6YbAQ/RQIFXXo4cQZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\findcheck = "C:\\Program Files (x86)\\findcheck\\findchecke.exe" findchecke.exe