Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/09/2024, 15:19
General
-
Target
YoudaoDict_fanyiweb_uia.exe
-
Size
146.6MB
-
MD5
7c1427add3279a3e808a72a21401d1ff
-
SHA1
3c90f4c761b32db39d223f38a72d7df654b91c26
-
SHA256
74f95519b3be1cad91d50eb40349eb02d77dd7228c79c3841fcca9475fdda2b0
-
SHA512
b258a46b45811c0d05c8acb255d3f56e5adc457b7766d91fedee9c6cbe0866acb691e2a5485c9da8df9d07103b420179b1c387178027c0e82c5b4cd6aa55e1da
-
SSDEEP
3145728:LrJWeuCMi8mRlR1QxJ/wCFeO7c30JPxzNW9piyj4w5Olvt0RXxO1:LrJWzC78+c/wCFeO700JPxhW7iyjb5OT
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 11 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_uia.exe"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_uia.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9UB5M.tmp\YoudaoDict_fanyiweb_uia.tmp"C:\Users\Admin\AppData\Local\Temp\is-9UB5M.tmp\YoudaoDict_fanyiweb_uia.tmp" /SL5="$30152,152943676,730624,C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_uia.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\dict\dict\Application\YoudaoDict_fanyiweb_navigation.exe"C:\Program Files (x86)\dict\dict\Application\YoudaoDict_fanyiweb_navigation.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\dict\dict\Application\Stable\YdExcelAddIncs.exe"C:\Program Files (x86)\dict\dict\Application\Stable\YdExcelAddIncs.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
584B
MD53f7da09311b9632df92173623aaa6145
SHA1b02c155b2f70671599965448d64a6f6479dbf0ef
SHA2561105b229c1437d45db30e0bbcc8736fed14ddfdfe957d05f590e0530a7d0925b
SHA512d477e6849946eb88544eefbd7913566b2675fbf00d7fff134049a1376de3d88d65316245d43680f639c00470da44d84bcaa3c611d59e2598c321f48d5dc053fe
-
Filesize
120B
MD53df54bba2137ec524f3fb39f2c61461a
SHA10c22a43aa3197066cef88cc7d507b4c7de33fcc1
SHA25647282a6fa1469e2d7bc8936d167c17ebf0fd800941104dd15097945208ccb501
SHA512e7462c492ff1eebe0a2843a70b64bcfd196f22163e87fc0774b1904553aa66524b511bab0d43d6a580863982ebd74162879431ac8e401a97e378c3a2d3fbf283
-
Filesize
8KB
MD582fbd90ae0a344cd29e538111ca3ad0e
SHA1f386c8168304dd744bac83f787606489b1163ed6
SHA256ae325f83cc63d67c533dc8d5406f7f502c61d2ab9fdb7befd511ce5ebc6ccbf1
SHA512f57fdaa5b368cfb08bf134123253f2ca664460af2b28d63576568a8112c7c86637afe82adcfc659cd60c5cf6440bbf9e33389bb5a2bc8cf7968dc0d4c4c12a28
-
Filesize
78KB
MD51b171f9a428c44acf85f89989007c328
SHA16f25a874d6cbf8158cb7c491dcedaa81ceaebbae
SHA2569d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c
SHA51299a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1
-
Filesize
95KB
MD5d0f23e47419a7f1b22197fc1ffb03e39
SHA119f60304ceeee3302bc8e4cf755ecffa8ef97056
SHA256a6402ac7b177d0947396e1aef8b39377e07b65f8cc510e6d137725fe723e32e6
SHA5123768e163fa02e6e27defeb7cf520a8e7f6386d5f4b93dddb08d870da8a6b289d3e25f184904bbf7b92059d2aef6061f501a503e5752f13678ededada07212023
-
Filesize
948KB
MD5664047844c7df994cfc22257fd91f77f
SHA16687cec1dcf749e57d88aa4a9ee52c42679ba41d
SHA2563f62a7b06b643aeed464c234513d8c72bdeec189604d5b883160abafa11b96c9
SHA5128ef408a0a202ccaf9c8fab0035fcaa21cd0ba52ae5def7c6e8cb0315d35a078a87db47966f645048d6aa2535872228a39f5f4d5ff0b61d19059a950e04765731
-
Filesize
2.4MB
MD51d47c25c177fc1f06242876f371d9976
SHA1339ce75996409f6820a5eaf537a5ab83b8e27f20
SHA256a00339e102ea0c367d3269bbeeaf62341a4e489740745d066b380b0179ae38ee
SHA512f01a9272397e6204bca0b9ec07f7db6be79bb803e8e782d52d264ed4bd79918db3b078bef39c67f4a2786ad597f8b4dbdd790eed50b7b3ef2bc43b3ba16e7efb
-
Filesize
38KB
MD5dab018047c171165c18329d5c59b617e
SHA188848ac4aceb7358f13d225de6d4fd0a5696517a
SHA2561cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA5121f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d
-
Filesize
38KB
MD55f7b90c87ea0517771862fae5f11ce94
SHA1fc9f195e888d960139278c04a0e78996c6442d5b
SHA256f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0
-
Filesize
3KB
MD55754c67775c3f4f50a4780b3bca026b1
SHA13e95c72c13d6175ef275280fe270d678acee46e9
SHA2562a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f
-
Filesize
908KB
MD53d3ec6392cf9a8b408569a3dd4cd3ce8
SHA195ff4346eb20d9239c37e6538bb8df8542d3300a
SHA256818f2cdb763f5af1884485cffef51f192bc895132a4fdff5009935e8348f8371
SHA512e017cfd88c50c496ac86084a43a80eb3f1ec61c6397a67da2978cbb1867a4b30f563f1b4f319d00742b84df486e841804b82949e3131c7d77b7f63975dece505
-
Filesize
95KB
MD55a94bf8916a11b5fe94aca44886c9393
SHA1820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA2560b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA51279cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20
-
Filesize
48KB
MD5765cf74fc709fb3450fa71aac44e7f53
SHA1b423271b4faac68f88fef15fa4697cf0149bad85
SHA256cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA5120c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
768KB
-
Filesize
668KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
