Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
906432
ubuntu-22.04-amd64
71.html
windows7-x64
31.html
windows10-2004-x64
3518_2.exe
windows7-x64
4518_2.exe
windows10-2004-x64
4520.exe
windows7-x64
4520.exe
windows10-2004-x64
410711.exe
windows7-x64
310711.exe
windows10-2004-x64
3711.exe
windows7-x64
7711.exe
windows10-2004-x64
7TSmm
ubuntu-24.04-amd64
7Drkv
ubuntu-22.04-amd64
10FCK_RSC.dll
windows7-x64
3FCK_RSC.dll
windows10-2004-x64
3FUCK360.exe
windows7-x64
7FUCK360.exe
windows10-2004-x64
10GetPass.exe
windows7-x64
3GetPass.exe
windows10-2004-x64
3HkMh.exe
windows7-x64
10HkMh.exe
windows10-2004-x64
10HkMh_2.exe
windows7-x64
7HkMh_2.exe
windows10-2004-x64
10HkMh_3.exe
windows7-x64
10HkMh_3.exe
windows10-2004-x64
10Killbash.x
ubuntu-24.04-amd64
3服务器(...r).exe
windows7-x64
6服务器(...r).exe
windows10-2004-x64
6ShellCodeDec.exe
windows7-x64
ShellCodeDec.exe
windows10-2004-x64
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 01:12
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
06432
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral4
Sample
1.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
1.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
518_2.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral7
Sample
518_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
520.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral9
Sample
520.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
10711.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
10711.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
711.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral13
Sample
711.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
TSmm
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral15
Sample
Drkv
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral16
Sample
FCK_RSC.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
FCK_RSC.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
FUCK360.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
FUCK360.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
GetPass.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
GetPass.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
HkMh.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral23
Sample
HkMh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
HkMh_2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
HkMh_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
HkMh_3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
HkMh_3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Killbash.x
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral29
Sample
服务器(Server)/服务器(Server).exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral30
Sample
服务器(Server)/服务器(Server).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
ShellCodeDec.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
ShellCodeDec.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
FUCK360.exe
-
Size
250KB
-
MD5
7ab51c2e2fdac53f3360bb5c8b73734e
-
SHA1
076d233ef06971a64f9b009c03627a491444a422
-
SHA256
8a7ad72fd6d3936ea3ad0ecadc063b382c6f0f8ff65b4839df1f3169f0135216
-
SHA512
35a6247f16a0295140782d0ea73754a37aafa09ba62d1f2be0a822d7f1b548921bad94b563ff16f1c817060544560f3c66856f0a85862cdbdfd85e29462abfee
-
SSDEEP
6144:XaLSyXt5iZ6hyebe81XrTE4/Cw5E2XppJZxA:qLtyGe81XU4rttQ
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral18/files/0x000700000001211a-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2164 gkmiuy.exe -
Loads dropped DLL 3 IoCs
pid Process 3068 FUCK360.exe 2164 gkmiuy.exe 2164 gkmiuy.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE FUCK360.exe File created C:\Windows\SysWOW64\hra33.dll gkmiuy.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\gkmiuy.exe FUCK360.exe File opened for modification C:\Windows\gkmiuy.exe FUCK360.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gkmiuy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCK360.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3068 FUCK360.exe 2164 gkmiuy.exe -
Suspicious behavior: MapViewOfSection 47 IoCs
pid Process 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 3068 FUCK360.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe 2164 gkmiuy.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3068 FUCK360.exe Token: SeDebugPrivilege 2164 gkmiuy.exe Token: SeTakeOwnershipPrivilege 3068 FUCK360.exe Token: SeRestorePrivilege 3068 FUCK360.exe Token: SeBackupPrivilege 3068 FUCK360.exe Token: SeChangeNotifyPrivilege 3068 FUCK360.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3068 FUCK360.exe 2164 gkmiuy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 384 3068 FUCK360.exe 3 PID 3068 wrote to memory of 384 3068 FUCK360.exe 3 PID 3068 wrote to memory of 384 3068 FUCK360.exe 3 PID 3068 wrote to memory of 384 3068 FUCK360.exe 3 PID 3068 wrote to memory of 384 3068 FUCK360.exe 3 PID 3068 wrote to memory of 384 3068 FUCK360.exe 3 PID 3068 wrote to memory of 384 3068 FUCK360.exe 3 PID 3068 wrote to memory of 392 3068 FUCK360.exe 4 PID 3068 wrote to memory of 392 3068 FUCK360.exe 4 PID 3068 wrote to memory of 392 3068 FUCK360.exe 4 PID 3068 wrote to memory of 392 3068 FUCK360.exe 4 PID 3068 wrote to memory of 392 3068 FUCK360.exe 4 PID 3068 wrote to memory of 392 3068 FUCK360.exe 4 PID 3068 wrote to memory of 392 3068 FUCK360.exe 4 PID 3068 wrote to memory of 432 3068 FUCK360.exe 5 PID 3068 wrote to memory of 432 3068 FUCK360.exe 5 PID 3068 wrote to memory of 432 3068 FUCK360.exe 5 PID 3068 wrote to memory of 432 3068 FUCK360.exe 5 PID 3068 wrote to memory of 432 3068 FUCK360.exe 5 PID 3068 wrote to memory of 432 3068 FUCK360.exe 5 PID 3068 wrote to memory of 432 3068 FUCK360.exe 5 PID 3068 wrote to memory of 476 3068 FUCK360.exe 6 PID 3068 wrote to memory of 476 3068 FUCK360.exe 6 PID 3068 wrote to memory of 476 3068 FUCK360.exe 6 PID 3068 wrote to memory of 476 3068 FUCK360.exe 6 PID 3068 wrote to memory of 476 3068 FUCK360.exe 6 PID 3068 wrote to memory of 476 3068 FUCK360.exe 6 PID 3068 wrote to memory of 476 3068 FUCK360.exe 6 PID 3068 wrote to memory of 492 3068 FUCK360.exe 7 PID 3068 wrote to memory of 492 3068 FUCK360.exe 7 PID 3068 wrote to memory of 492 3068 FUCK360.exe 7 PID 3068 wrote to memory of 492 3068 FUCK360.exe 7 PID 3068 wrote to memory of 492 3068 FUCK360.exe 7 PID 3068 wrote to memory of 492 3068 FUCK360.exe 7 PID 3068 wrote to memory of 492 3068 FUCK360.exe 7 PID 3068 wrote to memory of 500 3068 FUCK360.exe 8 PID 3068 wrote to memory of 500 3068 FUCK360.exe 8 PID 3068 wrote to memory of 500 3068 FUCK360.exe 8 PID 3068 wrote to memory of 500 3068 FUCK360.exe 8 PID 3068 wrote to memory of 500 3068 FUCK360.exe 8 PID 3068 wrote to memory of 500 3068 FUCK360.exe 8 PID 3068 wrote to memory of 500 3068 FUCK360.exe 8 PID 3068 wrote to memory of 592 3068 FUCK360.exe 9 PID 3068 wrote to memory of 592 3068 FUCK360.exe 9 PID 3068 wrote to memory of 592 3068 FUCK360.exe 9 PID 3068 wrote to memory of 592 3068 FUCK360.exe 9 PID 3068 wrote to memory of 592 3068 FUCK360.exe 9 PID 3068 wrote to memory of 592 3068 FUCK360.exe 9 PID 3068 wrote to memory of 592 3068 FUCK360.exe 9 PID 3068 wrote to memory of 668 3068 FUCK360.exe 10 PID 3068 wrote to memory of 668 3068 FUCK360.exe 10 PID 3068 wrote to memory of 668 3068 FUCK360.exe 10 PID 3068 wrote to memory of 668 3068 FUCK360.exe 10 PID 3068 wrote to memory of 668 3068 FUCK360.exe 10 PID 3068 wrote to memory of 668 3068 FUCK360.exe 10 PID 3068 wrote to memory of 668 3068 FUCK360.exe 10 PID 3068 wrote to memory of 756 3068 FUCK360.exe 11 PID 3068 wrote to memory of 756 3068 FUCK360.exe 11 PID 3068 wrote to memory of 756 3068 FUCK360.exe 11 PID 3068 wrote to memory of 756 3068 FUCK360.exe 11 PID 3068 wrote to memory of 756 3068 FUCK360.exe 11 PID 3068 wrote to memory of 756 3068 FUCK360.exe 11 PID 3068 wrote to memory of 756 3068 FUCK360.exe 11 PID 3068 wrote to memory of 808 3068 FUCK360.exe 12
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:392
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:824
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1196
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:668
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:960
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:236
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:344
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1064
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:2036
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2128
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1700
-
-
C:\Windows\gkmiuy.exeC:\Windows\gkmiuy.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2164
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\FUCK360.exe"C:\Users\Admin\AppData\Local\Temp\FUCK360.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD506be485186b658a88dfb242611651506
SHA1bcdfb1d45086ba1bfac457b3007ccd4b870091a0
SHA25633b73b618d55a90d2a20e4a3abfdc4abdc24a39105b849b3074c4601b4fd65bf
SHA51263c896d37800f1f0dd50f92c23665f7030c9a5954b25a2e7286059acfc6aed12446566c83feb4b3c822680a6d3d91bf6746006f3fdd109e2ae993e2d2c3e8bfe
-
Filesize
250KB
MD57ab51c2e2fdac53f3360bb5c8b73734e
SHA1076d233ef06971a64f9b009c03627a491444a422
SHA2568a7ad72fd6d3936ea3ad0ecadc063b382c6f0f8ff65b4839df1f3169f0135216
SHA51235a6247f16a0295140782d0ea73754a37aafa09ba62d1f2be0a822d7f1b548921bad94b563ff16f1c817060544560f3c66856f0a85862cdbdfd85e29462abfee
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
8KB
MD5aabeb05e642b2f9acb86a5dc1a600813
SHA1abba695b782c0e644b971b65d4dc7b8349714488
SHA2568b1d4870fdc940da538f225251996794f2f10ab7fff718d1aa884be8468dcfce
SHA512730fd04e4624f4db8c7c92e786148139d457c5bdc28badb3b1cbb70b61fd7b20655c2feab90c5c91b0d30f42a2d7bccb2ce0120752e223e6df2139c371b4be8a