Overview

overview

10

Static

static

y.rb.dll

windows7_x64

1

y.rb.dll

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-11-2020 20:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    y.rb.dll

  • Size

    421KB

  • MD5

    838c6c76b5f43793ba6a966ff3cfe1bf

  • SHA1

    e3e98f6f780c54a86af046a8612b984dbbe16a24

  • SHA256

    4f61fcafad37cc40632ad85e4f8aa503d63700761e49db19c122bffa7084e4ec

  • SHA512

    cc09c8b79f082046341adc5142ac9c22eea8ef3941d703b3f03a9a3cedf59920eeebfe83d89a6ee8e074ec7168156208b461a18f66c5ceb80b6d6def36eab6be

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 102 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\y.rb.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\y.rb.dll,#1
      2⤵
        PID:2036
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:324
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1636
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:1020
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:680

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/324-4-0x0000000006200000-0x0000000006223000-memory.dmp

      Filesize

      140KB

      Download

    • memory/1064-2-0x000007FEF5D40000-0x000007FEF5FBA000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2036-1-0x00000000001E0000-0x00000000001F0000-memory.dmp

      Filesize

      64KB

      Download