Overview
overview
3Static
static
3HSCAN/libmySQL.dll
windows7-x64
3HSCAN/libmySQL.dll
windows10-2004-x64
3HSCAN/oncrpc.dll
windows7-x64
3HSCAN/oncrpc.dll
windows10-2004-x64
3HSCAN/tools/NTCmd.exe
windows7-x64
1HSCAN/tools/NTCmd.exe
windows10-2004-x64
3HSCAN/tool...md.exe
windows7-x64
3HSCAN/tool...md.exe
windows10-2004-x64
3HSCAN/tool...19.dll
windows7-x64
3HSCAN/tool...19.dll
windows10-2004-x64
3HSCAN/tools/mysql.exe
windows7-x64
3HSCAN/tools/mysql.exe
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
HSCAN/libmySQL.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
HSCAN/libmySQL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
HSCAN/oncrpc.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
HSCAN/oncrpc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
HSCAN/tools/NTCmd.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
HSCAN/tools/NTCmd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
HSCAN/tools/Sqlcmd.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
HSCAN/tools/Sqlcmd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
HSCAN/tools/cygwinb19.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
HSCAN/tools/cygwinb19.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
HSCAN/tools/mysql.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
HSCAN/tools/mysql.exe
Resource
win10v2004-20241007-en
General
-
Target
HSCAN/tools/mysql.exe
-
Size
326KB
-
MD5
ab9e515e0368d649741859a2dde0d7cf
-
SHA1
33e3f4bea31df01d67bdadf49b683670fdc04209
-
SHA256
87adca958b90b161bd0358386fab5834cd34f12af111f09b827fe99c1c48b969
-
SHA512
9537979bb28cb6449334759a0123e085d43c9e4b9c93b7276570d0e93bec2f463131ecc984a01acc7f483e629ba3958465f1d9fe53bca41658c0cca853c88cc0
-
SSDEEP
6144:36Cmsj/XggGwiNUwhVM2T0QNAVAUS37bMcdJaVm+jUlASBaKcCP63zA0iZdlv66B:36Cmsj/X8BNUwLM2T0QNAGUS37bMKJyW
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mysql.exe