Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
9UDP.exe
windows7-x64
3UDP.exe
windows10-2004-x64
3a
ubuntu-24.04-amd64
8arm1
debian-9-armhf
4bj.exe
windows7-x64
10bj.exe
windows10-2004-x64
10bjyk.exe
windows7-x64
10bjyk.exe
windows10-2004-x64
10cctv.exe
windows7-x64
7cctv.exe
windows10-2004-x64
10cctv_2.exe
windows7-x64
1cctv_2.exe
windows10-2004-x64
10cn.exe
windows7-x64
7cn.exe
windows10-2004-x64
7cn1.exe
windows7-x64
7cn1.exe
windows10-2004-x64
3dhl.exe
windows7-x64
10dhl.exe
windows10-2004-x64
10java
ubuntu-18.04-amd64
4java (2)
ubuntu-24.04-amd64
1java1
ubuntu-24.04-amd64
7k5.exe
windows7-x64
8k5.exe
windows10-2004-x64
10ly1
debian-9-mips
3mh.exe
windows7-x64
10mh.exe
windows10-2004-x64
10mips
debian-12-mipsel
4pjhxx
ubuntu-24.04-amd64
1rootkit
ubuntu-24.04-amd64
8se.exe
windows7-x64
7Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 21:33
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
UDP.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
UDP.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
a
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral6
Sample
arm1
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral7
Sample
bj.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
bj.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
bjyk.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
bjyk.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
cctv.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
cctv.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
cctv_2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
cctv_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
cn.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
cn.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
cn1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
cn1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
dhl.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
dhl.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
java
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
java (2)
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral23
Sample
java1
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral24
Sample
k5.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral25
Sample
k5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
ly1
Resource
debian9-mipsbe-20240729-en
debian-9-mips
Behavioral task
behavioral27
Sample
mh.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
mh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
mips
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
Behavioral task
behavioral30
Sample
pjhxx
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral31
Sample
rootkit
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral32
Sample
se.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
cctv_2.exe
-
Size
48KB
-
MD5
e0a1361af24cc075e0cfb9e6a6a09cd3
-
SHA1
6b81a0773fd5a5f588302ef2231d2461544868aa
-
SHA256
71ef7e43615e286a5d424d2bafca90c03b05a1c216f1b3ac81997ee2d6bda8d7
-
SHA512
70815a447784599b423a4a4fb0c9d6821dd95244af8dd529ac51afa8d644ee16658cce748501b5f3283eec75ea1c967b225fb5400813f8fa5dc0c2dbe4de2401
-
SSDEEP
768:g+jOttjAoHTtNErVhg4xz8Jgo4KR3py9ma1Qxxbr:PiAgT0rVfF8JB4KR5omamx
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cctv_2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz cctv_2.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2788 cctv_2.exe -
Suspicious behavior: MapViewOfSection 24 IoCs
pid Process 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe 2788 cctv_2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2788 cctv_2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2788 wrote to memory of 384 2788 cctv_2.exe 3 PID 2788 wrote to memory of 384 2788 cctv_2.exe 3 PID 2788 wrote to memory of 384 2788 cctv_2.exe 3 PID 2788 wrote to memory of 384 2788 cctv_2.exe 3 PID 2788 wrote to memory of 384 2788 cctv_2.exe 3 PID 2788 wrote to memory of 384 2788 cctv_2.exe 3 PID 2788 wrote to memory of 384 2788 cctv_2.exe 3 PID 2788 wrote to memory of 392 2788 cctv_2.exe 4 PID 2788 wrote to memory of 392 2788 cctv_2.exe 4 PID 2788 wrote to memory of 392 2788 cctv_2.exe 4 PID 2788 wrote to memory of 392 2788 cctv_2.exe 4 PID 2788 wrote to memory of 392 2788 cctv_2.exe 4 PID 2788 wrote to memory of 392 2788 cctv_2.exe 4 PID 2788 wrote to memory of 392 2788 cctv_2.exe 4 PID 2788 wrote to memory of 432 2788 cctv_2.exe 5 PID 2788 wrote to memory of 432 2788 cctv_2.exe 5 PID 2788 wrote to memory of 432 2788 cctv_2.exe 5 PID 2788 wrote to memory of 432 2788 cctv_2.exe 5 PID 2788 wrote to memory of 432 2788 cctv_2.exe 5 PID 2788 wrote to memory of 432 2788 cctv_2.exe 5 PID 2788 wrote to memory of 432 2788 cctv_2.exe 5 PID 2788 wrote to memory of 480 2788 cctv_2.exe 6 PID 2788 wrote to memory of 480 2788 cctv_2.exe 6 PID 2788 wrote to memory of 480 2788 cctv_2.exe 6 PID 2788 wrote to memory of 480 2788 cctv_2.exe 6 PID 2788 wrote to memory of 480 2788 cctv_2.exe 6 PID 2788 wrote to memory of 480 2788 cctv_2.exe 6 PID 2788 wrote to memory of 480 2788 cctv_2.exe 6 PID 2788 wrote to memory of 488 2788 cctv_2.exe 7 PID 2788 wrote to memory of 488 2788 cctv_2.exe 7 PID 2788 wrote to memory of 488 2788 cctv_2.exe 7 PID 2788 wrote to memory of 488 2788 cctv_2.exe 7 PID 2788 wrote to memory of 488 2788 cctv_2.exe 7 PID 2788 wrote to memory of 488 2788 cctv_2.exe 7 PID 2788 wrote to memory of 488 2788 cctv_2.exe 7 PID 2788 wrote to memory of 496 2788 cctv_2.exe 8 PID 2788 wrote to memory of 496 2788 cctv_2.exe 8 PID 2788 wrote to memory of 496 2788 cctv_2.exe 8 PID 2788 wrote to memory of 496 2788 cctv_2.exe 8 PID 2788 wrote to memory of 496 2788 cctv_2.exe 8 PID 2788 wrote to memory of 496 2788 cctv_2.exe 8 PID 2788 wrote to memory of 496 2788 cctv_2.exe 8 PID 2788 wrote to memory of 588 2788 cctv_2.exe 9 PID 2788 wrote to memory of 588 2788 cctv_2.exe 9 PID 2788 wrote to memory of 588 2788 cctv_2.exe 9 PID 2788 wrote to memory of 588 2788 cctv_2.exe 9 PID 2788 wrote to memory of 588 2788 cctv_2.exe 9 PID 2788 wrote to memory of 588 2788 cctv_2.exe 9 PID 2788 wrote to memory of 588 2788 cctv_2.exe 9 PID 2788 wrote to memory of 672 2788 cctv_2.exe 10 PID 2788 wrote to memory of 672 2788 cctv_2.exe 10 PID 2788 wrote to memory of 672 2788 cctv_2.exe 10 PID 2788 wrote to memory of 672 2788 cctv_2.exe 10 PID 2788 wrote to memory of 672 2788 cctv_2.exe 10 PID 2788 wrote to memory of 672 2788 cctv_2.exe 10 PID 2788 wrote to memory of 672 2788 cctv_2.exe 10 PID 2788 wrote to memory of 748 2788 cctv_2.exe 11 PID 2788 wrote to memory of 748 2788 cctv_2.exe 11 PID 2788 wrote to memory of 748 2788 cctv_2.exe 11 PID 2788 wrote to memory of 748 2788 cctv_2.exe 11 PID 2788 wrote to memory of 748 2788 cctv_2.exe 11 PID 2788 wrote to memory of 748 2788 cctv_2.exe 11 PID 2788 wrote to memory of 748 2788 cctv_2.exe 11 PID 2788 wrote to memory of 816 2788 cctv_2.exe 12
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:588
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:2004
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1512
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:816
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1140
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:856
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:968
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:112
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:352
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1052
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1088
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1480
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2160
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\cctv_2.exe"C:\Users\Admin\AppData\Local\Temp\cctv_2.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788
-
-
C:\Users\Admin\AppData\Local\Temp\2090613244\zmstage.exeC:\Users\Admin\AppData\Local\Temp\2090613244\zmstage.exe1⤵PID:2992