Overview
overview
10Static
static
7ead791414b...d4.exe
windows7-x64
7ead791414b...d4.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3114IE.exe
windows7-x64
10114IE.exe
windows10-2004-x64
10bin/114Web.exe
windows7-x64
1bin/114Web.exe
windows10-2004-x64
1bin/Addr.dll
windows7-x64
3bin/Addr.dll
windows10-2004-x64
3bin/CameraDll.dll
windows7-x64
1bin/CameraDll.dll
windows10-2004-x64
1bin/SnapShot.exe
windows7-x64
1bin/SnapShot.exe
windows10-2004-x64
1bin/TGHistory.dll
windows7-x64
1bin/TGHistory.dll
windows10-2004-x64
1bin/TGMail.dll
windows7-x64
1bin/TGMail.dll
windows10-2004-x64
1bin/TGNetWork.dll
windows7-x64
1bin/TGNetWork.dll
windows10-2004-x64
3bin/TGRes.dll
windows7-x64
1bin/TGRes.dll
windows10-2004-x64
1bin/shdoclc.dll
windows7-x64
1bin/shdoclc.dll
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
-
max time kernel
141s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14-07-2024 23:09
Behavioral task
behavioral1
Sample
ead791414bf8b9f1126e4d6b099ecf939f595d03d5d30c69dc05c637806ea0d4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ead791414bf8b9f1126e4d6b099ecf939f595d03d5d30c69dc05c637806ea0d4.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
114IE.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
114IE.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
bin/114Web.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
bin/114Web.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
bin/Addr.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
bin/Addr.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
bin/CameraDll.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
bin/CameraDll.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
bin/SnapShot.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
bin/SnapShot.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
bin/TGHistory.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
bin/TGHistory.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
bin/TGMail.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
bin/TGMail.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
bin/TGNetWork.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
bin/TGNetWork.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
bin/TGRes.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
bin/TGRes.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
bin/shdoclc.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
bin/shdoclc.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
uninst.exe
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
uninst.exe
Resource
win10v2004-20240709-en
General
-
Target
bin/CameraDll.dll
-
Size
259KB
-
MD5
f6164e18be446ed9dbddcef2776923c8
-
SHA1
0de1a8af9848c8796fa09ae4e9488524800d2b3f
-
SHA256
ddd1c13886bdd148d1a1bcbe94e572d3bf54665a5f0711b7c5e823e6418a5caf
-
SHA512
f841e6b49ef108e5ccfd4dc47c4df53d82971449229648411554b275256b4a5fb2c998db3dfe30b757d9bf81ee4a6b76f8d773beae57347cb46eb495f78b3b9c
-
SSDEEP
6144:BjPK6XyF5LdYV7MEPkQu1DWhTBqi627nMDtd4:BjhX49dcsQsWhTsicd4
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1092 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1472 wrote to memory of 1092 1472 rundll32.exe 83 PID 1472 wrote to memory of 1092 1472 rundll32.exe 83 PID 1472 wrote to memory of 1092 1472 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\CameraDll.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\CameraDll.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:1092
-