Overview
overview
7Static
static
3YoudaoDict...lt.exe
windows10-2004-x64
7$PLUGINSDI...er.exe
windows10-2004-x64
3$PLUGINSDI...st.dll
windows10-2004-x64
3$PLUGINSDI...ng.dll
windows10-2004-x64
3$PLUGINSDI...ar.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows10-2004-x64
3$PLUGINSDI...tn.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...on.exe
windows10-2004-x64
$PLUGINSDI...er.exe
windows10-2004-x64
3$PLUGINSDI...ar.exe
windows10-2004-x64
3$PLUGINSDIR/child.rtf
windows10-2004-x64
18.10.0.0/CrashRpt.dll
windows10-2004-x64
38.10.0.0/Monitor.exe
windows10-2004-x64
38.10.0.0/T...32.dll
windows10-2004-x64
38.10.0.0/T...64.dll
windows10-2004-x64
18.10.0.0/W...32.dll
windows10-2004-x64
38.10.0.0/W...64.dll
windows10-2004-x64
18.10.0.0/XDLL.dll
windows10-2004-x64
38.10.0.0/Y...ct.dll
windows10-2004-x64
38.10.0.0/Y...t7.dll
windows10-2004-x64
38.10.0.0/Y...st.exe
windows10-2004-x64
38.10.0.0/Y...er.exe
windows10-2004-x64
38.10.0.0/Y...gin.js
windows10-2004-x64
3$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ow.dll
windows10-2004-x64
3$PLUGINSDI...cy.rtf
windows10-2004-x64
1$_67_/Inst...on.exe
windows10-2004-x64
3$_67_/Youd...er.exe
windows10-2004-x64
3uninst.exe
windows10-2004-x64
7Resubmissions
05-11-2024 09:43
241105-lpwmlsydrh 705-11-2024 09:39
241105-lm15bazbnl 705-11-2024 09:32
241105-lh19hsxrbx 7Analysis
-
max time kernel
137s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-11-2024 09:39
Behavioral task
behavioral1
Sample
YoudaoDict_webdict_default.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallHelper.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LockedList.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/OP_Logging.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/OP_ProgressBar.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/OP_WndProc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/YoudaoDictIcon.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/YoudaoDictInstaller.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/YoudaoToolbar.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/child.rtf
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
8.10.0.0/CrashRpt.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
8.10.0.0/Monitor.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
8.10.0.0/TextExtractorImpl32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
8.10.0.0/TextExtractorImpl64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
8.10.0.0/WordStrokeHelper32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
8.10.0.0/WordStrokeHelper64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
8.10.0.0/XDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
8.10.0.0/YodaoDict.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
8.10.0.0/YodaoDict7.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
8.10.0.0/YoudaoCookieAssist.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
8.10.0.0/YoudaoDictHelper.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
8.10.0.0/YoudaoDictPlugin.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/license.rtf
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsisSlideshow.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/privacy.rtf
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
$_67_/InstallDaemon.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
$_67_/YoudaoDictInstaller.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
uninst.exe
Resource
win10v2004-20241007-en
General
-
Target
uninst.exe
-
Size
2.3MB
-
MD5
99c42f396b337a63112b3622d3c2a772
-
SHA1
15e76e96b75fe8572824486dd255bafe7550790b
-
SHA256
56f80df77382343e628237e116acce9c7354233280606f8bb85704b7ff6e88ed
-
SHA512
61e0d7193465233434eb1b211290138298bc1b6e235672215b53a8e672fb02e0ae4b16bca49ac1cacc9804c80507174358ab365fd3fcb7db5a37148ab148bcec
-
SSDEEP
49152:xCCtWdpFMcrbtqxJ4PyLoXOmcSD02xyKq1P+zO7+eBT7+8Cq:SGcPtq4PPXOmcStyKq1P+zY+C
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation uninst.exe -
Executes dropped EXE 1 IoCs
pid Process 3200 YoudaoDictUninstallTemp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YoudaoDictUninstallTemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninst.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3136 uninst.exe 3200 YoudaoDictUninstallTemp.exe 3200 YoudaoDictUninstallTemp.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3136 wrote to memory of 2356 3136 uninst.exe 91 PID 3136 wrote to memory of 2356 3136 uninst.exe 91 PID 3136 wrote to memory of 2356 3136 uninst.exe 91 PID 2356 wrote to memory of 3200 2356 cmd.exe 93 PID 2356 wrote to memory of 3200 2356 cmd.exe 93 PID 2356 wrote to memory of 3200 2356 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YouDaoDictUninstallTemp.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\240626718\YoudaoDictUninstallTemp.exeC:\Users\Admin\AppData\Local\Temp\240626718\YoudaoDictUninstallTemp.exe -temp "C:\Users\Admin\AppData\Local\Temp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3200
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD599c42f396b337a63112b3622d3c2a772
SHA115e76e96b75fe8572824486dd255bafe7550790b
SHA25656f80df77382343e628237e116acce9c7354233280606f8bb85704b7ff6e88ed
SHA51261e0d7193465233434eb1b211290138298bc1b6e235672215b53a8e672fb02e0ae4b16bca49ac1cacc9804c80507174358ab365fd3fcb7db5a37148ab148bcec
-
Filesize
264B
MD588d7f6fb02f21ca3c5a2f371f20bf607
SHA10d6b97df455aaf4e0e1ab8fb158980d862c451fa
SHA256d4ecd8c51ddbc06fdff6056ab0d12cf5ad148d6b117c1242f74827d1e745e5e4
SHA5125192cfd87f119dcec1632f601355b11e72e22510ac60edd49a9a54700a5b92a9db7a8a15f86591bb48bd6e80e5e553bf4547317deafff205a4b8da2890af88b0