Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
906432
ubuntu-22.04-amd64
71.html
windows7-x64
31.html
windows10-2004-x64
3518_2.exe
windows7-x64
4518_2.exe
windows10-2004-x64
4520.exe
windows7-x64
4520.exe
windows10-2004-x64
410711.exe
windows7-x64
310711.exe
windows10-2004-x64
3711.exe
windows7-x64
7711.exe
windows10-2004-x64
7TSmm
ubuntu-24.04-amd64
7Drkv
ubuntu-22.04-amd64
10FCK_RSC.dll
windows7-x64
3FCK_RSC.dll
windows10-2004-x64
3FUCK360.exe
windows7-x64
7FUCK360.exe
windows10-2004-x64
10GetPass.exe
windows7-x64
3GetPass.exe
windows10-2004-x64
3HkMh.exe
windows7-x64
10HkMh.exe
windows10-2004-x64
10HkMh_2.exe
windows7-x64
7HkMh_2.exe
windows10-2004-x64
10HkMh_3.exe
windows7-x64
10HkMh_3.exe
windows10-2004-x64
10Killbash.x
ubuntu-24.04-amd64
3服务器(...r).exe
windows7-x64
6服务器(...r).exe
windows10-2004-x64
6ShellCodeDec.exe
windows7-x64
ShellCodeDec.exe
windows10-2004-x64
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 01:12
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
06432
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral4
Sample
1.html
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
1.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
518_2.exe
Resource
win7-20240729-en
Behavioral task
behavioral7
Sample
518_2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
520.exe
Resource
win7-20241010-en
Behavioral task
behavioral9
Sample
520.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
10711.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
10711.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
711.exe
Resource
win7-20240708-en
Behavioral task
behavioral13
Sample
711.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
TSmm
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral15
Sample
Drkv
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral16
Sample
FCK_RSC.dll
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
FCK_RSC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
FUCK360.exe
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
FUCK360.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
GetPass.exe
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
GetPass.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
HkMh.exe
Resource
win7-20241010-en
Behavioral task
behavioral23
Sample
HkMh.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
HkMh_2.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
HkMh_2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
HkMh_3.exe
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
HkMh_3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
Killbash.x
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral29
Sample
服务器(Server)/服务器(Server).exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
服务器(Server)/服务器(Server).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
ShellCodeDec.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
ShellCodeDec.exe
Resource
win10v2004-20241007-en
General
-
Target
10711.exe
-
Size
677KB
-
MD5
3ec6e71ee9670117bb68bce1172913cb
-
SHA1
f1891cce37b395e10314b369130cad628c9f87a6
-
SHA256
b388b34512371975ed665d676875ed1499ffbf7be9f74407e2c6f796efd4d8ef
-
SHA512
d167f125f64206f73f95cf42049b34a32e07fbbdd93c9b29956222f752d922f4f2d3da3b1bd7183728178b19cb35ac65f63489eda973ce13af542bc7fb7ecf19
-
SSDEEP
12288:49o2HYYuxp9Mc8QTmWWcGLh3OJMxFdYlBaCuYO4fN77OihGewG:jYuSWU+JMxKaC7f1i6zw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10711.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2552 10711.exe 2552 10711.exe