Bumblebee x1

显示全部楼层 · 发表于 2022-6-9 22:46:28

本帖最后由 anthonyqian 于 2022-6-9 22:55 编辑

来自MB。

执行方式：

rundll32 da4nos.dll, ajwGwRKhLi

复制代码

ESET扫描missed，ELG查杀。

显示全部楼层 · 发表于 2022-6-9 22:55:29

Kaspersky miss

显示全部楼层 · 发表于 2022-6-9 22:56:19

360 miss

显示全部楼层 · 发表于 2022-6-9 22:59:24

ikarus & vtss scan miss

显示全部楼层 · 发表于 2022-6-9 23:01:56

毒霸扫描miss

显示全部楼层 · 发表于 2022-6-9 23:05:21

HMPA拦截

The application, one of its loaded modules, or another process, has attempted to allocate memory with executable permissions to introduce additional code not part of the base program.

MITRE ATT&CK

Supply Chain Compromise - ID: T1195, Tactic: Initial Access

显示全部楼层 · 发表于 2022-6-9 23:31:42

本帖最后由 Hibike 于 2022-6-9 23:32 编辑

Mitigation HeapHeapProtect
Timestamp 2022-06-09T15:30:39
Platform 10.0.22000/x64 v943 06_8d*
PID 17636
Feature 007D0A30000000A6
Application C:\Windows\System32\rundll32.exe
Created 2022-05-14T06:29:55
Description Windows 主进程 (Rundll32) 10
Callee Type LoadLibrary
gdiplus.dll
0x00007FFF0BDFF000 (4096 bytes)
Shellcode (HHA) (0x00010000 bytes)
Owner of CALLER: (anonymous; allocated by 00007FFEAA41DE57, da4nos.dll)

复制代码

显示全部楼层 · 发表于 2022-6-9 23:48:47

火绒扫描 MISS

显示全部楼层 · 发表于 2022-6-10 00:00:42

补个红伞的，HEUR/APC

显示全部楼层 · 发表于 2022-6-10 00:03:08

卡巴已经拉黑了

[病毒样本] Bumblebee x1

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块