Overview
overview
10Static
static
10FSCapture-...wn.url
windows7-x64
6FSCapture-...wn.url
windows10-2004-x64
3FSCapture-...on.dll
windows7-x64
3FSCapture-...on.dll
windows10-2004-x64
3FSCapture-...01.dll
windows7-x64
3FSCapture-...01.dll
windows10-2004-x64
3FSCapture-...02.exe
windows7-x64
1FSCapture-...02.exe
windows10-2004-x64
1FSCapture-...03.exe
windows7-x64
3FSCapture-...03.exe
windows10-2004-x64
3FSCapture-...04.exe
windows7-x64
3FSCapture-...04.exe
windows10-2004-x64
3FSCapture-...05.dll
windows7-x64
3FSCapture-...05.dll
windows10-2004-x64
3FSCapture-...re.exe
windows7-x64
3FSCapture-...re.exe
windows10-2004-x64
3FSCapture-...ir.exe
windows7-x64
3FSCapture-...ir.exe
windows10-2004-x64
3FSCapture-...us.exe
windows7-x64
3FSCapture-...us.exe
windows10-2004-x64
3FSCapture-...er.exe
windows7-x64
3FSCapture-...er.exe
windows10-2004-x64
3FSCapture-...uv.dll
windows7-x64
3FSCapture-...uv.dll
windows10-2004-x64
3FSCapture-...bp.dll
windows7-x64
3FSCapture-...bp.dll
windows10-2004-x64
3FSCapture-...ng.bat
windows7-x64
10FSCapture-...ng.bat
windows10-2004-x64
10FSCapture-...se.exe
windows7-x64
10FSCapture-...se.exe
windows10-2004-x64
10FSCapture-...64.sys
windows7-x64
1FSCapture-...64.sys
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 04:46
Behavioral task
behavioral1
Sample
FSCapture-10.5-CN/bin/423Down.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FSCapture-10.5-CN/bin/423Down.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
FSCapture-10.5-CN/bin/FSCIcon.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
FSCapture-10.5-CN/bin/FSCIcon.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
FSCapture-10.5-CN/bin/FSCPlugin01.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
FSCapture-10.5-CN/bin/FSCPlugin01.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
FSCapture-10.5-CN/bin/FSCPlugin02.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
FSCapture-10.5-CN/bin/FSCPlugin02.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
FSCapture-10.5-CN/bin/FSCPlugin03.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
FSCapture-10.5-CN/bin/FSCPlugin03.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
FSCapture-10.5-CN/bin/FSCPlugin04.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
FSCapture-10.5-CN/bin/FSCPlugin04.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
FSCapture-10.5-CN/bin/FSCPlugin05.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
FSCapture-10.5-CN/bin/FSCPlugin05.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
FSCapture-10.5-CN/bin/FSCapture.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
FSCapture-10.5-CN/bin/FSCapture.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
FSCapture-10.5-CN/bin/FSCrossHair.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
FSCapture-10.5-CN/bin/FSCrossHair.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
FSCapture-10.5-CN/bin/FSFocus.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
FSCapture-10.5-CN/bin/FSFocus.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
FSCapture-10.5-CN/bin/FSRecorder.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
FSCapture-10.5-CN/bin/FSRecorder.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
FSCapture-10.5-CN/bin/libsharpyuv.dll
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
FSCapture-10.5-CN/bin/libsharpyuv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
FSCapture-10.5-CN/bin/libwebp.dll
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
FSCapture-10.5-CN/bin/libwebp.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
FSCapture-10.5-CN/bin/re/lib/CrashReporting.bat
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
FSCapture-10.5-CN/bin/re/lib/CrashReporting.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
FSCapture-10.5-CN/bin/re/lib/FSCapture_license.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
FSCapture-10.5-CN/bin/re/lib/FSCapture_license.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
FSCapture-10.5-CN/bin/re/lib/WinRing0x64.sys
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
FSCapture-10.5-CN/bin/re/lib/WinRing0x64.sys
Resource
win10v2004-20241007-en
General
-
Target
FSCapture-10.5-CN/bin/FSCPlugin04.exe
-
Size
1.6MB
-
MD5
892e8de79a793e25980d6266793f4117
-
SHA1
8e05aec70286cb01966a8af3c3e34f01d403be5a
-
SHA256
4c32447d4b2e332501bb808df6039f3473f917c9e9311aa896316be9ea13e80b
-
SHA512
5d110860292ff7458842fb7f1c5d1a92689a5ec547054b10fc96439c3efa43c6abaa228519e30df2146a1141ea4667446841082f4d0b6bd94c3bb71e262aa5df
-
SSDEEP
24576:VoExeBz7WVAOfBMrraVUTvUc/qntXPi0vUHlXyjYuwydiHJGKti69srFCxlalU4c:5LfCro+GPW9Hy5KtnICaLmOY
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSCPlugin04.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4788 FSCPlugin04.exe