Overview
overview
10Static
static
10FSCapture-...wn.url
windows7-x64
6FSCapture-...wn.url
windows10-2004-x64
3FSCapture-...on.dll
windows7-x64
3FSCapture-...on.dll
windows10-2004-x64
3FSCapture-...01.dll
windows7-x64
3FSCapture-...01.dll
windows10-2004-x64
3FSCapture-...02.exe
windows7-x64
1FSCapture-...02.exe
windows10-2004-x64
1FSCapture-...03.exe
windows7-x64
3FSCapture-...03.exe
windows10-2004-x64
3FSCapture-...04.exe
windows7-x64
3FSCapture-...04.exe
windows10-2004-x64
3FSCapture-...05.dll
windows7-x64
3FSCapture-...05.dll
windows10-2004-x64
3FSCapture-...re.exe
windows7-x64
3FSCapture-...re.exe
windows10-2004-x64
3FSCapture-...ir.exe
windows7-x64
3FSCapture-...ir.exe
windows10-2004-x64
3FSCapture-...us.exe
windows7-x64
3FSCapture-...us.exe
windows10-2004-x64
3FSCapture-...er.exe
windows7-x64
3FSCapture-...er.exe
windows10-2004-x64
3FSCapture-...uv.dll
windows7-x64
3FSCapture-...uv.dll
windows10-2004-x64
3FSCapture-...bp.dll
windows7-x64
3FSCapture-...bp.dll
windows10-2004-x64
3FSCapture-...ng.bat
windows7-x64
10FSCapture-...ng.bat
windows10-2004-x64
10FSCapture-...se.exe
windows7-x64
10FSCapture-...se.exe
windows10-2004-x64
10FSCapture-...64.sys
windows7-x64
1FSCapture-...64.sys
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 04:46
Behavioral task
behavioral1
Sample
FSCapture-10.5-CN/bin/423Down.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FSCapture-10.5-CN/bin/423Down.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
FSCapture-10.5-CN/bin/FSCIcon.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
FSCapture-10.5-CN/bin/FSCIcon.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
FSCapture-10.5-CN/bin/FSCPlugin01.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
FSCapture-10.5-CN/bin/FSCPlugin01.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
FSCapture-10.5-CN/bin/FSCPlugin02.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
FSCapture-10.5-CN/bin/FSCPlugin02.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
FSCapture-10.5-CN/bin/FSCPlugin03.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
FSCapture-10.5-CN/bin/FSCPlugin03.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
FSCapture-10.5-CN/bin/FSCPlugin04.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
FSCapture-10.5-CN/bin/FSCPlugin04.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
FSCapture-10.5-CN/bin/FSCPlugin05.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
FSCapture-10.5-CN/bin/FSCPlugin05.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
FSCapture-10.5-CN/bin/FSCapture.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
FSCapture-10.5-CN/bin/FSCapture.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
FSCapture-10.5-CN/bin/FSCrossHair.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
FSCapture-10.5-CN/bin/FSCrossHair.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
FSCapture-10.5-CN/bin/FSFocus.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
FSCapture-10.5-CN/bin/FSFocus.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
FSCapture-10.5-CN/bin/FSRecorder.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
FSCapture-10.5-CN/bin/FSRecorder.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
FSCapture-10.5-CN/bin/libsharpyuv.dll
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
FSCapture-10.5-CN/bin/libsharpyuv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
FSCapture-10.5-CN/bin/libwebp.dll
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
FSCapture-10.5-CN/bin/libwebp.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
FSCapture-10.5-CN/bin/re/lib/CrashReporting.bat
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
FSCapture-10.5-CN/bin/re/lib/CrashReporting.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
FSCapture-10.5-CN/bin/re/lib/FSCapture_license.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
FSCapture-10.5-CN/bin/re/lib/FSCapture_license.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
FSCapture-10.5-CN/bin/re/lib/WinRing0x64.sys
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
FSCapture-10.5-CN/bin/re/lib/WinRing0x64.sys
Resource
win10v2004-20241007-en
General
-
Target
FSCapture-10.5-CN/bin/FSCrossHair.exe
-
Size
631KB
-
MD5
effb23ab4ece53d5e07c8c0437d86bbe
-
SHA1
b695bda41c3b115375025b6a11e6e2cfe740eaee
-
SHA256
c0bcb458d844158f42f8be4da7187008115f849ff25d85aa00fa8637869ede2f
-
SHA512
cabffd4a53524a681db07784f5c8517545f730abec1adf5c79da4a91a61295eec266313ff631c1cdf2389c564c2d448a7b323a6122674617ba130e7f9b0a9f16
-
SSDEEP
12288:hIRXXg5ro19GsHuRwX6ZLs+O3EoKhjkiYkKhtmfCllQtpP/Z63iwwoZRr:hI+oGZRwqZLPO6jkiUf3lUP/Z63iwwoT
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSCrossHair.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2064 FSCrossHair.exe