Overview
overview
7Static
static
3YoudaoDict_crsky.exe
windows7-x64
7YoudaoDict_crsky.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Acrobat2Dict.dll
windows7-x64
3Acrobat2Dict.dll
windows10-2004-x64
3CrashRpt.dll
windows7-x64
3CrashRpt.dll
windows10-2004-x64
3InstallDaemon.exe
windows7-x64
3InstallDaemon.exe
windows10-2004-x64
3Monitor.exe
windows7-x64
3Monitor.exe
windows10-2004-x64
3RunDict.exe
windows7-x64
7RunDict.exe
windows10-2004-x64
7TextExtrac...32.dll
windows7-x64
3TextExtrac...32.dll
windows10-2004-x64
3TextExtrac...64.dll
windows7-x64
1TextExtrac...64.dll
windows10-2004-x64
1WordBook.exe
windows7-x64
3WordBook.exe
windows10-2004-x64
3WordStroke...32.dll
windows7-x64
3WordStroke...32.dll
windows10-2004-x64
3WordStroke...64.dll
windows7-x64
1WordStroke...64.dll
windows10-2004-x64
1XDLL.dll
windows7-x64
3XDLL.dll
windows10-2004-x64
3background.html
windows7-x64
3background.html
windows10-2004-x64
3lookup.js
windows7-x64
3lookup.js
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
YoudaoDict_crsky.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
YoudaoDict_crsky.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Acrobat2Dict.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Acrobat2Dict.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
CrashRpt.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
CrashRpt.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
InstallDaemon.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
InstallDaemon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Monitor.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Monitor.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
RunDict.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
RunDict.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
TextExtractorImpl32.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
TextExtractorImpl32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
TextExtractorImpl64.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
TextExtractorImpl64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
WordBook.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
WordBook.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
WordStrokeHelper32.dll
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
WordStrokeHelper32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
WordStrokeHelper64.dll
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
WordStrokeHelper64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
XDLL.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
XDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
background.html
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
background.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
lookup.js
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
lookup.js
Resource
win10v2004-20240802-en
General
-
Target
YoudaoDict_crsky.exe
-
Size
5.0MB
-
MD5
722107a7992c996f3cd6643ada68a5b2
-
SHA1
5efcb4d387160e15fe8580243eb55918ef2321af
-
SHA256
c03e16449f67eeb2f73ac2dcf61b1dcc0a6f7520f97844931244b1646b4784b2
-
SHA512
20e5397d6eb04f68e706ffc0253df4bf094ede2270e2c565fa6142a2707d672f676e714b656f80b0be67d8094ac73268c40f5c1e6de12e7a0b27030422d8f88d
-
SSDEEP
98304:1CnulpP58XxoZPhp4xzJE+wvvgUMfbEH6jZ1R0FmuCieOQLNbpUUGaA:1CnapOXxoZPhKxzJMngU6bEaZ18mbNbc
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2292 YoudaoDict_crsky.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YoudaoDict_crsky.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2292 YoudaoDict_crsky.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD5cc7c65b56dfb726fe223fb7bd15ffa3d
SHA13bbc997be3f9e800f1c16f3137a205610cec0fc7
SHA256c48cfae8da09e501eb6f3b21b31d802c05b3c4d4b5e67f7d8df1f0750106fb3e
SHA512b1576fd33399e4187f13c83b83288f0d7dd2b43b9ebbcf5cd8cb0bd62afbafcfdd1134a9c2bee0077ad371b3cb3ce5d0895db8f8369bc306b647ff9401d5b825
-
Filesize
33KB
MD5c6e1bd79c42fae30f95db66d168ca034
SHA17cdd4a01b55b5e99b3f007e67c0f403e996af456
SHA2564f13328bf6a006897b0ea5481a27fc96bc1edcf7eeb9816023f583471af2d5bb
SHA5123b3214907be4c54362d615cdbe1dd7993fe825c8ae8cca76c8e27549bb3155a9c4970c2cf2711a97bf280f1958cf1aa41864226e2a68d32e6343c3704a9856f1