Overview
overview
9Static
static
5MSS32.dll
windows7-x64
9MSS32.dll
windows10-2004-x64
9SiberMT2.exe
windows7-x64
5SiberMT2.exe
windows10-2004-x64
5SiberRadyo.exe
windows7-x64
3SiberRadyo.exe
windows10-2004-x64
3hshield/Up...i2.dll
windows7-x64
3hshield/Up...i2.dll
windows10-2004-x64
3hshield/Up...tl.dll
windows7-x64
3hshield/Up...tl.dll
windows10-2004-x64
3hshield/Up...up.exe
windows7-x64
6hshield/Up...up.exe
windows10-2004-x64
6hshield/Up...32.dll
windows7-x64
3hshield/Up...32.dll
windows10-2004-x64
3hshield/ahnrpt.exe
windows7-x64
7hshield/ahnrpt.exe
windows10-2004-x64
7$PLUGINSDI...pt.exe
windows7-x64
3$PLUGINSDI...pt.exe
windows10-2004-x64
3$PLUGINSDI...et.dll
windows7-x64
3$PLUGINSDI...et.dll
windows10-2004-x64
3$PLUGINSDI...PI.dll
windows7-x64
3$PLUGINSDI...PI.dll
windows10-2004-x64
3hshield/ahnupctl.dll
windows7-x64
3hshield/ahnupctl.dll
windows10-2004-x64
3hshield/ahnupgs.dll
windows7-x64
3hshield/ahnupgs.dll
windows10-2004-x64
3hshield/as...om.dll
windows7-x64
3hshield/as...om.dll
windows10-2004-x64
3hshield/as...dh.dll
windows7-x64
3hshield/as...dh.dll
windows10-2004-x64
3hshield/as...se.dll
windows7-x64
3hshield/as...se.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 11:35
Behavioral task
behavioral1
Sample
MSS32.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
MSS32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
SiberMT2.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
SiberMT2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
SiberRadyo.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
SiberRadyo.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
hshield/Update/ahni2.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
hshield/Update/ahni2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
hshield/Update/ahnupctl.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
hshield/Update/ahnupctl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
hshield/Update/autoup.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
hshield/Update/autoup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
hshield/Update/v3bz32.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
hshield/Update/v3bz32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
hshield/ahnrpt.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
hshield/ahnrpt.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/AhnRpt.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/AhnRpt.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/Cabinet.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/Cabinet.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/PackAPI.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/PackAPI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
hshield/ahnupctl.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
hshield/ahnupctl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
hshield/ahnupgs.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
hshield/ahnupgs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
hshield/asc/asc_com.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
hshield/asc/asc_com.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
hshield/asc/asc_dh.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
hshield/asc/asc_dh.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
hshield/asc/asc_fse.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
hshield/asc/asc_fse.dll
Resource
win10v2004-20240802-en
General
-
Target
SiberRadyo.exe
-
Size
28KB
-
MD5
3481d325532678d1b7107acc0da2ad20
-
SHA1
ed88a6c2f09aa57758d33df20f884897d9ab4fee
-
SHA256
6c6fd0b58e14b7e9f18e194bdf34b47d359ebd4e9466e8a228136706c7d3aa4d
-
SHA512
487ae5076d1754ce775a7dac440b4de8eba311174cf10e15907660bd0532c91d0fccc1681710035c8964d9b1e2ce2291c70b00280d3f7d6795be41fe0d69a349
-
SSDEEP
384:GZw1L6H48940OQh6z1yD2jWazRw1L6H48:aCXQh6zm2Rp
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SiberRadyo.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main SiberRadyo.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2344 SiberRadyo.exe 2344 SiberRadyo.exe 2344 SiberRadyo.exe