Overview

overview

10

Static

static

10

SUNBURST/A...34.dll

windows7_x64

1

SUNBURST/A...34.dll

windows10_x64

1

SUNBURST/A...77.dll

windows7_x64

1

SUNBURST/A...77.dll

windows10_x64

SUNBURST/A...bc.dll

windows7_x64

1

SUNBURST/A...bc.dll

windows10_x64

1

SUNBURST/A...d6.dll

windows7_x64

1

SUNBURST/A...d6.dll

windows10_x64

1

SUNBURST/A...af.dll

windows7_x64

1

SUNBURST/A...af.dll

windows10_x64

1

SUNBURST/A...8d.dll

windows7_x64

1

SUNBURST/A...8d.dll

windows10_x64

1

SUNBURST/A...71.dll

windows7_x64

1

SUNBURST/A...71.dll

windows10_x64

1

SUNBURST/F...ad.dll

windows7_x64

1

SUNBURST/F...ad.dll

windows10_x64

1

SUNBURST/F...e5.dll

windows7_x64

1

SUNBURST/F...e5.dll

windows10_x64

1

SUNBURST/F...6d.exe

windows7_x64

1

SUNBURST/F...6d.exe

windows10_x64

1

SUNBURST/F...91.exe

windows7_x64

1

SUNBURST/F...91.exe

windows10_x64

1

SUNBURST/F...0c.dll

windows7_x64

1

SUNBURST/F...0c.dll

windows10_x64

3

SUNBURST/F...d9.dll

windows7_x64

8

SUNBURST/F...d9.dll

windows10_x64

8

SUNBURST/F...a6.exe

windows7_x64

3

SUNBURST/F...a6.exe

windows10_x64

3

SUNBURST/F...65.exe

windows7_x64

1

SUNBURST/F...65.exe

windows10_x64

1

SUNBURST/F...40.exe

windows7_x64

1

SUNBURST/F...40.exe

windows10_x64

1

Analysis

  • max time kernel
    146s
  • max time network
    169s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-12-2020 20:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SUNBURST/FireEyeTools/1cf5710e500a423b84b51fa3afdd923fe0a8255c5817d3238175623e2ebbfad9.dll

  • Size

    688KB

  • MD5

    a91bf61cc18705be2288a0f6f125068f

  • SHA1

    d535de08875cef1c49bfa2532281fa1254a8cb93

  • SHA256

    1cf5710e500a423b84b51fa3afdd923fe0a8255c5817d3238175623e2ebbfad9

  • SHA512

    a7c9a05f0d1a2b868ec608ac4dc116fd79fb36728bc4f371e9eab3cadb869b6ac53dd97cbf64a7d18ce237430cdd08f64ebab7b68ac39f3bf486d772be3a96dc

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SUNBURST\FireEyeTools\1cf5710e500a423b84b51fa3afdd923fe0a8255c5817d3238175623e2ebbfad9.dll,#1
    1⤵
    • Blocklisted process makes network request
    PID:3884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3884-3-0x000002A7A8620000-0x000002A7A8621000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3884-2-0x00007FFF6D540000-0x00007FFF6DF2C000-memory.dmp
    Filesize

    9.9MB

    Download