Overview

overview

10

Static

static

3

网易有�...��.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    网易有道翻译.exe

  • Size

    124.6MB

  • Sample

    240820-q892kavgme

  • MD5

    3c7902f8780d25c75927b7f822015046

  • SHA1

    0a9083c2a0e5ea8ef44ae0a8eaff41fb86633147

  • SHA256

    7fba736320971975317c51eb6ea07398ada991a3c0175e1318a554022b95936c

  • SHA512

    ebe15b2bee980ca5ca5b38a970a47f0486ab91ac31d634803557d2b58cfc71d6944474a6870e44d83eba30155482059b751925b24b5a8a765d1c97852e280668

  • SSDEEP

    3145728:JwXtRIbRtjonSpelDp6V0TNLfhy41aqWB1If8uH2:KX4b1ezi01pNO1IEuW

Score
10/10
discovery

Malware Config

Targets

    • Target

      网易有道翻译.exe

    • Size

      124.6MB

    • MD5

      3c7902f8780d25c75927b7f822015046

    • SHA1

      0a9083c2a0e5ea8ef44ae0a8eaff41fb86633147

    • SHA256

      7fba736320971975317c51eb6ea07398ada991a3c0175e1318a554022b95936c

    • SHA512

      ebe15b2bee980ca5ca5b38a970a47f0486ab91ac31d634803557d2b58cfc71d6944474a6870e44d83eba30155482059b751925b24b5a8a765d1c97852e280668

    • SSDEEP

      3145728:JwXtRIbRtjonSpelDp6V0TNLfhy41aqWB1If8uH2:KX4b1ezi01pNO1IEuW

    Score
    10/10
    discovery

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks