在sandbox目录查到的 C2 Stager1X

tony099

vt:44/72   https://www.virustotal.com/gui/f ... f4bb58182/detection

Creation Time
2025-12-09 11:59:43 UTC

First Submission
2025-12-16 19:10:37 UTC

Last Submission
2025-12-19 13:45:08 UTC

Last Analysis
2025-12-19 08:31:32 UTC


链接：米店不卖大米通过QQ闪传分享了【ConfigChase.zip】
https://qfile.qq.com/q/SDq03z8tGe

22222221

HMPA kill
Mitigation   C2Interceptor
SubType      Stager
Tag          SigDynamicAPI
Timestamp    2025-12-19T13:56:30

Platform     10.0.19045/x64 v2019 af_50
PID          688
Feature      00FD2E70000002A2
Application  C:\Users\Administrator\Desktop\ConfigChase.exe
Created      2025-12-19T13:56:28
Description  ConfigChase.exe


**** Looks like a stager ****

Stack Trace
#  Address          Module                   Location
-- ---------------- ------------------------ ----------------------------------------
1  000002BEC66D0126 (anonymous; ConfigChase.exe)
                    eb59                     JMP          0x2bec66d0181

2  000002BEC66D036A (anonymous; ConfigChase.exe)

Loaded Modules (36)
-----------------------------------------------------------------------------
00007FF792EB0000-00007FF792FC2000 ConfigChase.exe (),
                                  version:
00007FF9445D0000-00007FF9447C8000 ntdll.dll (Microsoft Corporation),
                                  version: 10.0.19041.4842 (WinBuild.160101.0800)
00007FF8FE320000-00007FF8FE459000 hmpalert.dll (Sophos B.V.),
                                  version: 3.20.2.2019
00007FF943E30000-00007FF943EF1000 KERNEL32.dll (Microsoft Corporation),
                                  version: 10.0.19041.4842 (WinBuild.160101.0800)
00007FF942270000-00007FF94256D000 KERNELBASE.dll (Microsoft Corporation),
                                  version: 10.0.19041.4842 (WinBuild.160101.0800)
00007FF93F1F0000-00007FF93F284000 apphelp.dll (Microsoft Corporation),
                                  version: 10.0.19041.4842 (WinBuild.160101.0800)
00007FF941EC0000-00007FF941FC0000 ucrtbase.dll (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF9440D0000-00007FF94426D000 USER32.dll (Microsoft Corporation),
                                  version: 10.0.19041.4717 (WinBuild.160101.0800)
00007FF941FC0000-00007FF941FE2000 win32u.dll (Microsoft Corporation),
                                  version: 10.0.19041.4894 (WinBuild.160101.0800)
00007FF942A30000-00007FF942A5B000 GDI32.dll (Microsoft Corporation),
                                  version: 10.0.19041.4474 (WinBuild.160101.0800)
00007FF942100000-00007FF942217000 gdi32full.dll (Microsoft Corporation),
                                  version: 10.0.19041.4717 (WinBuild.160101.0800)
00007FF941FF0000-00007FF94208D000 msvcp_win.dll (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF943240000-00007FF94326F000 IMM32.DLL (Microsoft Corporation),
                                  version: 10.0.19041.4474 (WinBuild.160101.0800)
00007FF943D60000-00007FF943DCB000 Ws2_32.dll (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF943BA0000-00007FF943CC3000 RPCRT4.dll (Microsoft Corporation),
                                  version: 10.0.19041.4597 (WinBuild.160101.0800)
00007FF941340000-00007FF9413AA000 mswsock.dll (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF933180000-00007FF933658000 wininet.DLL (Microsoft Corporation),
                                  version: 11.00.19041.4717 (WinBuild.160101.0800)
00007FF943F10000-00007FF943FAE000 msvcrt.dll (Microsoft Corporation),
                                  version: 7.0.19041.3636 (WinBuild.160101.0800)
00007FF943320000-00007FF9433D0000 advapi32.dll (Microsoft Corporation),
                                  version: 10.0.19041.4597 (WinBuild.160101.0800)
00007FF943270000-00007FF943310000 sechost.dll (Microsoft Corporation),
                                  version: 10.0.19041.4597 (WinBuild.160101.0800)
00007FF941E90000-00007FF941EB7000 bcrypt.dll (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF936640000-00007FF9368FE000 iertutil.dll (Microsoft Corporation),
                                  version: 11.00.19041.4894 (WinBuild.160101.0800)
00007FF942600000-00007FF942953000 combase.dll (Microsoft Corporation),
                                  version: 10.0.19041.4717 (WinBuild.160101.0800)
00007FF942960000-00007FF942A0D000 shcore.dll (Microsoft Corporation),
                                  version: 10.0.19041.4522 (WinBuild.160101.0800)
00007FF936610000-00007FF936638000 srvcli.dll (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF941130000-00007FF94113C000 netutils.dll (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF941B30000-00007FF941B62000 SspiCli.dll (Microsoft Corporation),
                                  version: 10.0.19041.4239 (WinBuild.160101.0800)
00007FF93FD20000-00007FF9404C3000 windows.storage.dll (Microsoft Corporation),
                                  version: 10.0.19041.4894 (WinBuild.160101.0800)
00007FF9415E0000-00007FF94160E000 Wldp.dll (Microsoft Corporation),
                                  version: 10.0.19041.4780 (WinBuild.160101.0800)
00007FF943110000-00007FF9431DD000 OLEAUT32.dll (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF944350000-00007FF9443A5000 shlwapi.dll (Microsoft Corporation),
                                  version: 10.0.19041.4355 (WinBuild.160101.0800)
00007FF941BB0000-00007FF941BD4000 profapi.dll (Microsoft Corporation),
                                  version: 10.0.19041.4355 (WinBuild.160101.0800)
00007FF9268C0000-00007FF9268D7000 ondemandconnroutehelper.dll (Microsoft Corporation),
                                  version: 10.0.19041.4355 (WinBuild.160101.0800)
00007FF93AF10000-00007FF93B01D000 winhttp.dll (Microsoft Corporation),
                                  version: 10.0.19041.4717 (WinBuild.160101.0800)
00007FF93FB20000-00007FF93FB32000 kernel.appcore.dll (Microsoft Corporation),
                                  version: 10.0.19041.3758 (WinBuild.160101.0800)
00007FF941020000-00007FF94105B000 IPHLPAPI.DLL (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF93CFB0000-00007FF93CFBB000 WINNSI.DLL (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)
00007FF943100000-00007FF943108000 NSI.dll (Microsoft Corporation),
                                  version: 10.0.19041.3636 (WinBuild.160101.0800)

Process Trace
1  C:\Users\Administrator\Desktop\ConfigChase.exe [688]
2  C:\Windows\explorer.exe [3460]

Dropped Files
1  C:\Users\Administrator\Desktop\Victorâ

asdfnbbj

360扫描报毒

GDHJDSYDH

红伞 kill

superLYT

EIS解压不杀，双击不杀。话说这VT都红了一片了，ESET怎么还没反应

LingGao

Microsoft Defender

“ConfigChase.exe”
Trojan:Win32/Znyonm!rfn

啊松

jxfaiu

解压秒