Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
9UDP.exe
windows7-x64
3UDP.exe
windows10-2004-x64
3a
ubuntu-24.04-amd64
8arm1
debian-9-armhf
4bj.exe
windows7-x64
10bj.exe
windows10-2004-x64
10bjyk.exe
windows7-x64
10bjyk.exe
windows10-2004-x64
10cctv.exe
windows7-x64
7cctv.exe
windows10-2004-x64
10cctv_2.exe
windows7-x64
1cctv_2.exe
windows10-2004-x64
10cn.exe
windows7-x64
7cn.exe
windows10-2004-x64
7cn1.exe
windows7-x64
7cn1.exe
windows10-2004-x64
3dhl.exe
windows7-x64
10dhl.exe
windows10-2004-x64
10java
ubuntu-18.04-amd64
4java (2)
ubuntu-24.04-amd64
1java1
ubuntu-24.04-amd64
7k5.exe
windows7-x64
8k5.exe
windows10-2004-x64
10ly1
debian-9-mips
3mh.exe
windows7-x64
10mh.exe
windows10-2004-x64
10mips
debian-12-mipsel
4pjhxx
ubuntu-24.04-amd64
1rootkit
ubuntu-24.04-amd64
8se.exe
windows7-x64
7Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 21:33
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
UDP.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
UDP.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
a
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral6
Sample
arm1
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral7
Sample
bj.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
bj.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
bjyk.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
bjyk.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
cctv.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
cctv.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
cctv_2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
cctv_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
cn.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
cn.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
cn1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
cn1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
dhl.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
dhl.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
java
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
java (2)
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral23
Sample
java1
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral24
Sample
k5.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral25
Sample
k5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
ly1
Resource
debian9-mipsbe-20240729-en
debian-9-mips
Behavioral task
behavioral27
Sample
mh.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
mh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
mips
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
Behavioral task
behavioral30
Sample
pjhxx
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral31
Sample
rootkit
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral32
Sample
se.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
k5.exe
-
Size
76KB
-
MD5
145c9edca1151d477e5c339b6d797cbd
-
SHA1
f09d773d50f87c47500305e79bc1e6fcf503ebd6
-
SHA256
ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da
-
SHA512
10f5d6cacbbc96fa22c097f5b519fe1738a5531820518af00cedf8ca9112808bc2c2871845f85f496a1d08695441262ab3ed57068e6d029ec1e5aabdb32d47df
-
SSDEEP
1536:bcPk2vG+Yq6GrXdOOq52m0HLxEulgsteEY+cZv8FYOicNx1q/6:v2vGM6GLdu52hHL6ulgsteEY+cZ90Nx1
Malware Config
Signatures
-
Modifies RDP port number used by Windows 1 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 2876 zmxrwy.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\zmxrwy.exe k5.exe File opened for modification C:\Windows\zmxrwy.exe k5.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zmxrwy.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 zmxrwy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString zmxrwy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz zmxrwy.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2772 k5.exe 2876 zmxrwy.exe -
Suspicious behavior: MapViewOfSection 47 IoCs
pid Process 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2772 k5.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe 2876 zmxrwy.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2772 k5.exe Token: SeDebugPrivilege 2876 zmxrwy.exe Token: SeIncBasePriorityPrivilege 2772 k5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 368 2772 k5.exe 3 PID 2772 wrote to memory of 368 2772 k5.exe 3 PID 2772 wrote to memory of 368 2772 k5.exe 3 PID 2772 wrote to memory of 368 2772 k5.exe 3 PID 2772 wrote to memory of 368 2772 k5.exe 3 PID 2772 wrote to memory of 368 2772 k5.exe 3 PID 2772 wrote to memory of 368 2772 k5.exe 3 PID 2772 wrote to memory of 384 2772 k5.exe 4 PID 2772 wrote to memory of 384 2772 k5.exe 4 PID 2772 wrote to memory of 384 2772 k5.exe 4 PID 2772 wrote to memory of 384 2772 k5.exe 4 PID 2772 wrote to memory of 384 2772 k5.exe 4 PID 2772 wrote to memory of 384 2772 k5.exe 4 PID 2772 wrote to memory of 384 2772 k5.exe 4 PID 2772 wrote to memory of 420 2772 k5.exe 5 PID 2772 wrote to memory of 420 2772 k5.exe 5 PID 2772 wrote to memory of 420 2772 k5.exe 5 PID 2772 wrote to memory of 420 2772 k5.exe 5 PID 2772 wrote to memory of 420 2772 k5.exe 5 PID 2772 wrote to memory of 420 2772 k5.exe 5 PID 2772 wrote to memory of 420 2772 k5.exe 5 PID 2772 wrote to memory of 468 2772 k5.exe 6 PID 2772 wrote to memory of 468 2772 k5.exe 6 PID 2772 wrote to memory of 468 2772 k5.exe 6 PID 2772 wrote to memory of 468 2772 k5.exe 6 PID 2772 wrote to memory of 468 2772 k5.exe 6 PID 2772 wrote to memory of 468 2772 k5.exe 6 PID 2772 wrote to memory of 468 2772 k5.exe 6 PID 2772 wrote to memory of 476 2772 k5.exe 7 PID 2772 wrote to memory of 476 2772 k5.exe 7 PID 2772 wrote to memory of 476 2772 k5.exe 7 PID 2772 wrote to memory of 476 2772 k5.exe 7 PID 2772 wrote to memory of 476 2772 k5.exe 7 PID 2772 wrote to memory of 476 2772 k5.exe 7 PID 2772 wrote to memory of 476 2772 k5.exe 7 PID 2772 wrote to memory of 484 2772 k5.exe 8 PID 2772 wrote to memory of 484 2772 k5.exe 8 PID 2772 wrote to memory of 484 2772 k5.exe 8 PID 2772 wrote to memory of 484 2772 k5.exe 8 PID 2772 wrote to memory of 484 2772 k5.exe 8 PID 2772 wrote to memory of 484 2772 k5.exe 8 PID 2772 wrote to memory of 484 2772 k5.exe 8 PID 2772 wrote to memory of 584 2772 k5.exe 9 PID 2772 wrote to memory of 584 2772 k5.exe 9 PID 2772 wrote to memory of 584 2772 k5.exe 9 PID 2772 wrote to memory of 584 2772 k5.exe 9 PID 2772 wrote to memory of 584 2772 k5.exe 9 PID 2772 wrote to memory of 584 2772 k5.exe 9 PID 2772 wrote to memory of 584 2772 k5.exe 9 PID 2772 wrote to memory of 664 2772 k5.exe 10 PID 2772 wrote to memory of 664 2772 k5.exe 10 PID 2772 wrote to memory of 664 2772 k5.exe 10 PID 2772 wrote to memory of 664 2772 k5.exe 10 PID 2772 wrote to memory of 664 2772 k5.exe 10 PID 2772 wrote to memory of 664 2772 k5.exe 10 PID 2772 wrote to memory of 664 2772 k5.exe 10 PID 2772 wrote to memory of 748 2772 k5.exe 11 PID 2772 wrote to memory of 748 2772 k5.exe 11 PID 2772 wrote to memory of 748 2772 k5.exe 11 PID 2772 wrote to memory of 748 2772 k5.exe 11 PID 2772 wrote to memory of 748 2772 k5.exe 11 PID 2772 wrote to memory of 748 2772 k5.exe 11 PID 2772 wrote to memory of 748 2772 k5.exe 11 PID 2772 wrote to memory of 792 2772 k5.exe 12
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:584
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1248
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1556
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:664
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:792
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1160
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:832
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:268
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:108
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1056
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1092
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1240
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:3052
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2208
-
-
C:\Windows\zmxrwy.exeC:\Windows\zmxrwy.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:476
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\k5.exe"C:\Users\Admin\AppData\Local\Temp\k5.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5145c9edca1151d477e5c339b6d797cbd
SHA1f09d773d50f87c47500305e79bc1e6fcf503ebd6
SHA256ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da
SHA51210f5d6cacbbc96fa22c097f5b519fe1738a5531820518af00cedf8ca9112808bc2c2871845f85f496a1d08695441262ab3ed57068e6d029ec1e5aabdb32d47df