Overview

overview

8

Static

static

5

xiangrikgui.exe

windows10-2004-x64

8

xiangrikgui.exe

windows11-21h2-x64

8

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

dllloader_v2.dll

windows10-2004-x64

8

dllloader_v2.dll

windows11-21h2-x64

8

xiangrikui.exe

windows10-2004-x64

5

xiangrikui.exe

windows11-21h2-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    xiangrikgui.exe
  • Size 70.2MB
  • Sample250910-wh5baasvcw
  • SHA256 0455ed6abd6758907267ba9e09155bc8b1f430e2b60a33c1e1aaebf92471a32e
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
defense_evasiondiscoveryexecutionupx

Malware Config

Targets

    • Target
      xiangrikgui.exe
    • Size 70.2MB
    • SHA256 0455ed6abd6758907267ba9e09155bc8b1f430e2b60a33c1e1aaebf92471a32e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    defense_evasiondiscoveryexecutionupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      dllloader_v2.dll
    • Size 118KB
    • SHA256 e44fbb09238220f72216405fe75ec049634ad6731575e9b464254433ab448ff2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    defense_evasiondiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Drops file in System32 directory

    • Enumerates processes with tasklist

      discovery
    behavioral5behavioral6
    • Target
      xiangrikui.exe
    • Size 69.4MB
    • SHA256 b1154374d1293b990af7d3ff3524d98522639e13e37a2d4f705b52695e51cf37
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral7behavioral8

MITRE ATT&CK Enterprise v16

Tasks