44795e52c8dc01ffd12f46860c846d2fb4c96590460f203de1ba7b0cef7488a8 | Triage

Sharing

General

Target

44795e52c8dc01ffd12f46860c846d2fb4c96590460f203de1ba7b0cef7488a8N.exe
Size

2.7MB
Sample

240925-sna3vascpq
MD5

ea86c29af63ae7abba49ccdaf764a410
SHA1

0f612e4c32ffc51195a2cfa47d2662cf2d6746f5
SHA256

44795e52c8dc01ffd12f46860c846d2fb4c96590460f203de1ba7b0cef7488a8
SHA512

a8415f795378b6cc8fa9ebe6fcb3465bf0cb842eef3a7095da7b6c770272410d178a7052cad7ea7979bed440fac528796845192ffd2fb91a7cf345c2aa6cd737
SSDEEP

49152:RGbfKn/I20ni4HqK4VZ5xdzBLG14EGLA59oLTVm/6/qQXlwQr:RGbfKnw22tz4BLQ4EGLM9ocHomK

Score

3^/10

discovery

Malware Config

Targets

- Target
  
  44795e52c8dc01ffd12f46860c846d2fb4c96590460f203de1ba7b0cef7488a8N.exe
- Size
  
  2.7MB
- MD5
  
  ea86c29af63ae7abba49ccdaf764a410
- SHA1
  
  0f612e4c32ffc51195a2cfa47d2662cf2d6746f5
- SHA256
  
  44795e52c8dc01ffd12f46860c846d2fb4c96590460f203de1ba7b0cef7488a8
- SHA512
  
  a8415f795378b6cc8fa9ebe6fcb3465bf0cb842eef3a7095da7b6c770272410d178a7052cad7ea7979bed440fac528796845192ffd2fb91a7cf345c2aa6cd737
- SSDEEP
  
  49152:RGbfKn/I20ni4HqK4VZ5xdzBLG14EGLA59oLTVm/6/qQXlwQr:RGbfKnw22tz4BLQ4EGLM9ocHomK
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/BDMSkin.dll
- Size
  
  1.3MB
- MD5
  
  2b94c1cbe8a0554d4f4f258401f49de4
- SHA1
  
  21dd6ef60e1141aba20deab2fe49cea3d063016a
- SHA256
  
  65650bad47296ddb5314c1a21cf631352ffcf0a13073a0f561fd254f22671258
- SHA512
  
  a05b673e8796adbd51e4540f8ef0c9a4239e007604ee531b898aa2c9abace1589fb37bf194001b9081f9ca0a33a4f071b4ec3ce70a3a8d28ff73a2436e5f0a9d
- SSDEEP
  
  24576:32FI6RnkgBdFFaSYp8dESTaztGU5oIFAaEnav:yTaXWNoFAa
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/InstallHelper.dll
- Size
  
  624KB
- MD5
  
  6aabf9c5699a0a4b21e367a53c6f1326
- SHA1
  
  5cba57b98fbc4444ef2eba474a1ea7f0f824bc2b
- SHA256
  
  384511f6a598e51c4cd63470fdd5b24bf16f0c5608909e367e9c592679fc103e
- SHA512
  
  9502cd6f9e254e99c6e4ce56da0fdf91cc7db8b02680f899cf05835921508e267d7e15053535d94d431c9ce0f39f6dad8a1fc28e571f30ff27fbe6be6e1aa001
- SSDEEP
  
  12288:jToLg9aG8/ebn/kzGaSVXyt4tXyeA4A+1wKi63+vsTkLc3c:taGIeb/sGaGXxth5HBTk4s
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/Microsoft.VC80.ATL/atl80.dll
- Size
  
  95KB
- MD5
  
  3e9a33113d663d8bd5ed38858e669652
- SHA1
  
  1292dc7ffc35a1ef2b761672361bcffa7483169e
- SHA256
  
  63e1985a37d5993d170373bc28d067c13c1541ca2b63968b82e35eaacd927b49
- SHA512
  
  a2dcd0d5db662653d3085d2ab39e8697b25e096fd2093e3f5ca2edb3087356814adb9f99e490dc95293198e05551a3ddbb3fa2918b8ed5f76d84a22268bfbe7a
- SSDEEP
  
  1536:SskNTnYQzkuvliN+9sdYhfv3rkT+za16/rWmE9dV87mKxGXmwkbos3co9:S1TnY4kclz9sdO/o9dVMmXmwkl
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/Microsoft.VC80.CRT/msvcm80.dll
- Size
  
  468KB
- MD5
  
  75f2a9b695ef3ef22d731f059920f636
- SHA1
  
  e665f073f8eba6482d8fa26d5a213c607d8470ec
- SHA256
  
  e645846ffd536957f51fbe223e1dee0f834a5fc7043d956a71e6933c1ce5ad9e
- SHA512
  
  8eed3eaf4e4e3217bafa1b5a009a739aa5663c6ce86f81aef88995f4bd2b2296f2c09b935e7294ff24fded72a0c2e5ea95f3acfa96023eded328b88b050c182d
- SSDEEP
  
  6144:C6KTZsHDwx0TCAQpFTfnPyrerCqq/KruohQFHCxrgtaoOjMQlyD:4sHDG0TMAxKFhQRCxrcQ
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/Microsoft.VC80.CRT/msvcp80.dll
- Size
  
  541KB
- MD5
  
  8c53ccd787c381cd535d8dcca12584d8
- SHA1
  
  bc7ce60270a58450596aa3e3e5d0a99f731333d9
- SHA256
  
  384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528
- SHA512
  
  e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755
- SSDEEP
  
  12288:UZY4lOHMwLwXBt+ia3htSUa/hUgiW6QR7t5j3Ooc8NHkC2eSQ:UZY4lOHMM8wiShtSj3Ooc8NHkC2eT
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/Microsoft.VC80.CRT/msvcr80.dll
- Size
  
  617KB
- MD5
  
  1169436ee42f860c7db37a4692b38f0e
- SHA1
  
  4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3
- SHA256
  
  9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46
- SHA512
  
  e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0
- SSDEEP
  
  12288:bxzh9hH5RVKTp0G+vjhr46CIw+0yZmGyYCj:bph9hHzVKOpXwymGyYo
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/SkinResources/$WINDIR/Temp/baidu/youqian/YouQian_Setup.exe
- Size
  
  1.2MB
- MD5
  
  c68f49d332f0a8d280b36f9c6c5377c9
- SHA1
  
  9a440a7cddbb8981465315860b393a749fca8b8a
- SHA256
  
  c05a8107a23a74504b96a3177d8543d8c779c4c01abf007d21aba717ff58c0af
- SHA512
  
  31ed6977e860867af98e1274fc3c9c6b12cd4bd10cc5b19840e1c4cca48d58dc470c9c162520cfd82e02d9086d1d73dd0376bda7a4affedf3f08832c261f36e6
- SSDEEP
  
  24576:V30GU3jTV9BJ/2Ek2fUzjztBLtMQfNG8nPmwcJmQtyX7FeO3:Hq/zBJeN2czjzLWQfDnEBtyX7V
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/InstallHelper.dll
- Size
  
  259KB
- MD5
  
  c43b117a2e73c52537b599a921928c8f
- SHA1
  
  89000b81161e9e9108b31996550983334b993fbb
- SHA256
  
  16e77610644fa909f3ca3f88e87dafaac0d111623d82b5c6ed1b481b6aed7ac3
- SHA512
  
  41cb5f459020c92a3e3590bbb66eff6834c848db60d83708bb061353dd165f3037694f2e026e17a85397799e3d006d8ea31024cad6a3eba362b5b0d14201bd77
- SSDEEP
  
  3072:DyK3fcD6HWn/OFNl6NgHoXpuk+jmNfhNYLiOhSrgdA5Hu+9P5GtFp+qI:Dy6f+6Hsm8XXfksMdQrue
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  23KB
- MD5
  
  cc89ba33a301a9545248fc538a27fa87
- SHA1
  
  4043d78bfd08a1319a72f1dad292175ba3939ba3
- SHA256
  
  b41e673a2009d024afd7c1f151fa320cd86e85c4532961b1c0d797558eacb9a7
- SHA512
  
  6b9d4debd8b326cde4e3111ce6feec49345b2480453b5da332134564d26e7f92f130176bcffc1867c051694f0c6e691ca090884eaa7ca64e62a3179a87bc52a2
- SSDEEP
  
  384:/M4T0MKT/Xwr2izZQ86mpAT8F9lN8Ov0JwnYPLQa6jvjeMwG:E5MKzwTFnVX8i0wym
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/file/BDSGReportPlugin.dll
- Size
  
  338KB
- MD5
  
  aa3419b4a210f331f0d58bb367ce478e
- SHA1
  
  27d8efe0d9db519ca0449d7e0daeaeb6c136d46f
- SHA256
  
  bd83fcf4e132ca169b585861f1e606e6d97fd00e32ac7c9c4c1ce4c19b1663b9
- SHA512
  
  af3e48333bb6c2f93d2e55451913de39ed47aba67c02a1ea8e4bb65ba9b371ce47bc2755700f9a1eda862d8409ccc6b61d0b40ba69eda440c477e054248022a1
- SSDEEP
  
  6144:q8faZHl48oMnYj7LcZKbNQlT5BTBZ6bUmJOgsl/+:JGvoM6ncYQXBTD6nm+
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/file/HIPS.dll
- Size
  
  1.9MB
- MD5
  
  58da9fa0a0d2aea565b0083444856fdd
- SHA1
  
  2fe34ce74906ea8b8b09a227a1359561e42d4ef9
- SHA256
  
  6312bead72e76b97e36502046a171f05a6d956eeb56081c3d91ac25dd567864c
- SHA512
  
  80459b2c1f0617516e01691d612808bbf55df2cc9845e775cde899375d89c1822a5a4f74df971c2e20e8f6d8d16b22f8bd8f5b379addb63bbcce2ca3bd13a0a9
- SSDEEP
  
  24576:QUnjwvfO1Q7oiAwNFQfMiF6mN58aQSyCUIGJ66QM3JVGm1wRxTF9zFJ5bC+uKdA:QUn+Gw/PvU58aGE7vTF9RbbVndA
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/file/baiduanRepair.dll
- Size
  
  538KB
- MD5
  
  9f5cca6aa8e02e26f027e45a296c63a3
- SHA1
  
  af7c11c8fb15266455a3d3a68d25285126319a3c
- SHA256
  
  81516e610a98040e4ae6b643a2699c6c87d56bce1372ff78935026cad6a590ac
- SHA512
  
  73d54b0928b0ea42f01913e57a75d3d584527c0ffcc7b62d30f6bfcd334961d21d0c54ad2a61147cecd1a4ba5ff2aad2459f2c908c412c36b8388d2008e2d615
- SSDEEP
  
  12288:XF5iW8fh7J8k9M0WDUWsrki6u/lUqUUTei5RZcyv0+T9SzhkLmT2PQuFZy3cX:XF5O3nXT9ckLmT2ouFZy34
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/file/baidusdRepair.dll
- Size
  
  538KB
- MD5
  
  2e57ac6d1a967edd25957308a44c8afc
- SHA1
  
  7473ca53c112a64fa28455df07f104aa90010d00
- SHA256
  
  ac73df5a8d4a5e9e555e2a0afc703cb4c9087b86584f449213714cfb98326c62
- SHA512
  
  2a837687b20eaf4049d4cf3387d1fdd859c1793cc92cd94c430084ebc58aaaa788041f0f7bda7e38145a6e3c63b2052f2f514d0eb7aca537f698eb3a7c4c1a6d
- SSDEEP
  
  12288:0c4P9sFOrtvqaqSvjIBj9r3sTTrTuDi9iJzp:j4P9sFoqmv8BhsTTPuDi9iJzp
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  Microsoft.VC80.ATL/atl80.dll
- Size
  
  95KB
- MD5
  
  3e9a33113d663d8bd5ed38858e669652
- SHA1
  
  1292dc7ffc35a1ef2b761672361bcffa7483169e
- SHA256
  
  63e1985a37d5993d170373bc28d067c13c1541ca2b63968b82e35eaacd927b49
- SHA512
  
  a2dcd0d5db662653d3085d2ab39e8697b25e096fd2093e3f5ca2edb3087356814adb9f99e490dc95293198e05551a3ddbb3fa2918b8ed5f76d84a22268bfbe7a
- SSDEEP
  
  1536:SskNTnYQzkuvliN+9sdYhfv3rkT+za16/rWmE9dV87mKxGXmwkbos3co9:S1TnY4kclz9sdO/o9dVMmXmwkl
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  Microsoft.VC80.CRT/msvcm80.dll
- Size
  
  468KB
- MD5
  
  75f2a9b695ef3ef22d731f059920f636
- SHA1
  
  e665f073f8eba6482d8fa26d5a213c607d8470ec
- SHA256
  
  e645846ffd536957f51fbe223e1dee0f834a5fc7043d956a71e6933c1ce5ad9e
- SHA512
  
  8eed3eaf4e4e3217bafa1b5a009a739aa5663c6ce86f81aef88995f4bd2b2296f2c09b935e7294ff24fded72a0c2e5ea95f3acfa96023eded328b88b050c182d
- SSDEEP
  
  6144:C6KTZsHDwx0TCAQpFTfnPyrerCqq/KruohQFHCxrgtaoOjMQlyD:4sHDG0TMAxKFhQRCxrcQ
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32