Overview
overview
10Static
static
10FSCapture-...wn.url
windows7-x64
6FSCapture-...wn.url
windows10-2004-x64
3FSCapture-...on.dll
windows7-x64
3FSCapture-...on.dll
windows10-2004-x64
3FSCapture-...01.dll
windows7-x64
3FSCapture-...01.dll
windows10-2004-x64
3FSCapture-...02.exe
windows7-x64
1FSCapture-...02.exe
windows10-2004-x64
1FSCapture-...03.exe
windows7-x64
3FSCapture-...03.exe
windows10-2004-x64
3FSCapture-...04.exe
windows7-x64
3FSCapture-...04.exe
windows10-2004-x64
3FSCapture-...05.dll
windows7-x64
3FSCapture-...05.dll
windows10-2004-x64
3FSCapture-...re.exe
windows7-x64
3FSCapture-...re.exe
windows10-2004-x64
3FSCapture-...ir.exe
windows7-x64
3FSCapture-...ir.exe
windows10-2004-x64
3FSCapture-...us.exe
windows7-x64
3FSCapture-...us.exe
windows10-2004-x64
3FSCapture-...er.exe
windows7-x64
3FSCapture-...er.exe
windows10-2004-x64
3FSCapture-...uv.dll
windows7-x64
3FSCapture-...uv.dll
windows10-2004-x64
3FSCapture-...bp.dll
windows7-x64
3FSCapture-...bp.dll
windows10-2004-x64
3FSCapture-...ng.bat
windows7-x64
10FSCapture-...ng.bat
windows10-2004-x64
10FSCapture-...se.exe
windows7-x64
10FSCapture-...se.exe
windows10-2004-x64
10FSCapture-...64.sys
windows7-x64
1FSCapture-...64.sys
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 04:46
Behavioral task
behavioral1
Sample
FSCapture-10.5-CN/bin/423Down.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FSCapture-10.5-CN/bin/423Down.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
FSCapture-10.5-CN/bin/FSCIcon.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
FSCapture-10.5-CN/bin/FSCIcon.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
FSCapture-10.5-CN/bin/FSCPlugin01.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
FSCapture-10.5-CN/bin/FSCPlugin01.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
FSCapture-10.5-CN/bin/FSCPlugin02.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
FSCapture-10.5-CN/bin/FSCPlugin02.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
FSCapture-10.5-CN/bin/FSCPlugin03.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
FSCapture-10.5-CN/bin/FSCPlugin03.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
FSCapture-10.5-CN/bin/FSCPlugin04.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
FSCapture-10.5-CN/bin/FSCPlugin04.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
FSCapture-10.5-CN/bin/FSCPlugin05.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
FSCapture-10.5-CN/bin/FSCPlugin05.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
FSCapture-10.5-CN/bin/FSCapture.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
FSCapture-10.5-CN/bin/FSCapture.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
FSCapture-10.5-CN/bin/FSCrossHair.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
FSCapture-10.5-CN/bin/FSCrossHair.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
FSCapture-10.5-CN/bin/FSFocus.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
FSCapture-10.5-CN/bin/FSFocus.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
FSCapture-10.5-CN/bin/FSRecorder.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
FSCapture-10.5-CN/bin/FSRecorder.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
FSCapture-10.5-CN/bin/libsharpyuv.dll
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
FSCapture-10.5-CN/bin/libsharpyuv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
FSCapture-10.5-CN/bin/libwebp.dll
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
FSCapture-10.5-CN/bin/libwebp.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
FSCapture-10.5-CN/bin/re/lib/CrashReporting.bat
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
FSCapture-10.5-CN/bin/re/lib/CrashReporting.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
FSCapture-10.5-CN/bin/re/lib/FSCapture_license.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
FSCapture-10.5-CN/bin/re/lib/FSCapture_license.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
FSCapture-10.5-CN/bin/re/lib/WinRing0x64.sys
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
FSCapture-10.5-CN/bin/re/lib/WinRing0x64.sys
Resource
win10v2004-20241007-en
General
-
Target
FSCapture-10.5-CN/bin/FSFocus.exe
-
Size
636KB
-
MD5
97aa518d2a3b2ad63573128c7e10e6c5
-
SHA1
88cd0bc2496025a7979393807dcc089ba09bd9e8
-
SHA256
493b2b08ecadd1895c4fcfe0ffd9c7b2b4f5b276ccd494846e0cb35de004ad91
-
SHA512
1a77895b740191ccdfcb3377528ef1b907bc138297d5eea7bcefa23d65ebcbcc11f29eba70151c570928eca099c2c87a1ae1d94226a19dbb0c2ee459ac371256
-
SSDEEP
12288:9IuPNeBhqk/28pUgna9ref4+/dFPfwCXrUhgIZXu8C6Z:9IkeBVpRna98dlzeu8b
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSFocus.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1880 FSFocus.exe