Overview
overview
3Static
static
3VwMeter/DeLib.dll
windows7-x64
3VwMeter/DeLib.dll
windows10-2004-x64
3VwMeter/De...st.dll
windows7-x64
1VwMeter/De...st.dll
windows10-2004-x64
1VwMeter/VwMeter.exe
windows7-x64
3VwMeter/VwMeter.exe
windows10-2004-x64
3VwMeter/VwUpdate.exe
windows7-x64
3VwMeter/VwUpdate.exe
windows10-2004-x64
3VwMeter/�...��.url
windows7-x64
1VwMeter/�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30-08-2024 21:40
Static task
static1
Behavioral task
behavioral1
Sample
VwMeter/DeLib.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
VwMeter/DeLib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
VwMeter/DeLibSys32test.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
VwMeter/DeLibSys32test.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
VwMeter/VwMeter.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
VwMeter/VwMeter.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
VwMeter/VwUpdate.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
VwMeter/VwUpdate.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
VwMeter/新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
VwMeter/新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
VwMeter/VwMeter.exe
-
Size
294KB
-
MD5
515ea3ec7a961dfdbdf4849d561559f5
-
SHA1
ca256fc0e38446171e5722b276e05a700dbf4a06
-
SHA256
7586a222983bac061034d0612bd744abc851bb95f821d6e73e92ef746976b85b
-
SHA512
00c2ab6e3f6b477561232522daffcb09980d0d9410ab13d4a912ddbededb58bfe47754bd8acb04c0cadaabac8e1e0737eca0bd7cc53290dae34e84d950bae60a
-
SSDEEP
6144:2i4S+cPWaLTCW3e0dZfFgCZTdsmnEla3ex2v3ANBbwuE:k9cuaF1dTdxGmnOauK9J
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VwMeter.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3856 VwMeter.exe 3856 VwMeter.exe 3856 VwMeter.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3856 VwMeter.exe 3856 VwMeter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VwMeter\VwMeter.exe"C:\Users\Admin\AppData\Local\Temp\VwMeter\VwMeter.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56B
MD535ac3caeaa1addc81fc391964fd5eabe
SHA1d7f34a9bf50b47b65be2af678cc7e3c7c0552f79
SHA256a740f105eafb985eebed1580d701479034f9a4340113795aa9dc49cade0adcbc
SHA5127a4a4075168df9ed346794016afff9c8a04b404a082b74076d3e1798093df3121fb4e8c86f729f50cce4e3a54e959f3b01e1ae465f1fa4a502098838ca1a2fd4