Overview
overview
10Static
static
10Bin1799/Ca...ll.exe
windows7-x64
10Bin1799/Ca...ll.exe
windows10-2004-x64
10Bin1799/Client.exe
windows7-x64
5Bin1799/Client.exe
windows10-2004-x64
5Bin1799/Pl...u.html
windows7-x64
3Bin1799/Pl...u.html
windows10-2004-x64
3Bin1799/Pl...E.html
windows7-x64
3Bin1799/Pl...E.html
windows10-2004-x64
3Bin1799/Pl...e.html
windows7-x64
3Bin1799/Pl...e.html
windows10-2004-x64
3Bin1799/Pl...E.html
windows7-x64
3Bin1799/Pl...E.html
windows10-2004-x64
3Bin1799/Pl...32.exe
windows7-x64
3Bin1799/Pl...32.exe
windows10-2004-x64
3Bin1799/Pl...64.exe
windows7-x64
1Bin1799/Pl...64.exe
windows10-2004-x64
1Bin1799/Pl...te.exe
windows7-x64
3Bin1799/Pl...te.exe
windows10-2004-x64
3Bin1799/Pl...ck.exe
windows7-x64
5Bin1799/Pl...ck.exe
windows10-2004-x64
5Bin1799/Pl...de.bat
windows7-x64
10Bin1799/Pl...de.bat
windows10-2004-x64
10Bin1799/Pl...de.exe
windows7-x64
1Bin1799/Pl...de.exe
windows10-2004-x64
3Bin1799/Pl...eo.dll
windows7-x64
1Bin1799/Pl...eo.dll
windows10-2004-x64
1Bin1799/Pl...ax.dll
windows7-x64
3Bin1799/Pl...ax.dll
windows10-2004-x64
3Bin1799/Pl..._t.dll
windows7-x64
3Bin1799/Pl..._t.dll
windows10-2004-x64
3Bin1799/SkinH.dll
windows7-x64
5Bin1799/SkinH.dll
windows10-2004-x64
5Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 09:20
Behavioral task
behavioral1
Sample
Bin1799/Cache/Install.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bin1799/Cache/Install.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Bin1799/Client.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Bin1799/Client.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Bin1799/Plugins/Baidu.html
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Bin1799/Plugins/Baidu.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Bin1799/Plugins/BaiduE.html
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Bin1799/Plugins/BaiduE.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Bin1799/Plugins/Gaode.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Bin1799/Plugins/Gaode.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Bin1799/Plugins/GaodeE.html
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Bin1799/Plugins/GaodeE.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Bin1799/Plugins/GetPswd32.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Bin1799/Plugins/GetPswd32.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Bin1799/Plugins/GetPswd64.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Bin1799/Plugins/GetPswd64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Bin1799/Plugins/IPUpdate.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Bin1799/Plugins/IPUpdate.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Bin1799/Plugins/PcLock.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Bin1799/Plugins/PcLock.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Bin1799/Plugins/ShellCode.bat
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Bin1799/Plugins/ShellCode.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Bin1799/Plugins/ShellCode.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
Bin1799/Plugins/ShellCode.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Bin1799/Plugins/bPluginVideo.dll
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
Bin1799/Plugins/bPluginVideo.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Bin1799/Plugins/mstscax.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Bin1799/Plugins/mstscax.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Bin1799/Plugins/termsrv_t.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Bin1799/Plugins/termsrv_t.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Bin1799/SkinH.dll
Resource
win7-20240903-en
General
-
Target
Bin1799/Client.exe
-
Size
6.4MB
-
MD5
3ea0814ab437a2774715a017289f32e7
-
SHA1
7de855de88853661570379bbc462cd0629a89d6e
-
SHA256
cf5fd9e1027a8d18fcd4b7a8ed2c2e9ff42649185bebf702d4dc85160a5af688
-
SHA512
5f2c95c6a6cb0660fc13652d463f736e8fe053740c6043015176d90d54be3a3462ad9bafcee25cb757da7aaba1cf23ff89f6ddb08b059bebc60f78bdf1f24f81
-
SSDEEP
98304:UiMF2kiCaBKBoB5gXngUD4ruTfUDFtE5LsnsQa45:UiaWKGBapD4ruT8DFtE5LsnsQR
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral3/memory/2496-0-0x0000000010000000-0x000000001003B000-memory.dmp upx behavioral3/memory/2496-2-0x0000000010000000-0x000000001003B000-memory.dmp upx behavioral3/memory/2496-4-0x0000000010000000-0x000000001003B000-memory.dmp upx behavioral3/memory/2496-3-0x0000000010000000-0x000000001003B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Client.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Client.exepid process 2496 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Client.exepid process 2496 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Client.exepid process 2496 Client.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
Client.exepid process 2496 Client.exe 2496 Client.exe 2496 Client.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bin1799\Client.exe"C:\Users\Admin\AppData\Local\Temp\Bin1799\Client.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2496