d3f4d352d63d7565acc222c50c0fccf56a7d90ad1623ae32e3a7f0e3b9ea5dfc

Submit
Reports

Overview

overview

Static

static

08af470338...22.exe

windows7_x64

08af470338...22.exe

windows10_x64

1a86f37c48...38.exe

windows7_x64

1a86f37c48...38.exe

windows10_x64

1b729638fb...87.exe

windows7_x64

1b729638fb...87.exe

windows10_x64

1dda56e38d...28.exe

windows7_x64

1dda56e38d...28.exe

windows10_x64

1e6d2544e8...94.exe

windows7_x64

1e6d2544e8...94.exe

windows10_x64

2b08e7b15a...9.xlsx

windows7_x64

2b08e7b15a...9.xlsx

windows10_x64

3fda6fd600...6e.dll

windows7_x64

3fda6fd600...6e.dll

windows10_x64

4b69264d21...91.exe

windows7_x64

4b69264d21...91.exe

windows10_x64

4b7659b234...63.exe

windows7_x64

4b7659b234...63.exe

windows10_x64

4bb4e4e1b4...91.xls

windows7_x64

4bb4e4e1b4...91.xls

windows10_x64

4c4420fc81...96.exe

windows7_x64

4c4420fc81...96.exe

windows10_x64

4e8b50459a...7d.dll

windows7_x64

4e8b50459a...7d.dll

windows10_x64

4ec8577958...f.xlsx

windows7_x64

4ec8577958...f.xlsx

windows10_x64

6abf4544f6...cd.exe

windows7_x64

6abf4544f6...cd.exe

windows10_x64

6f0f5ac2a0...8e.exe

windows7_x64

6f0f5ac2a0...8e.exe

windows10_x64

6f7620033e...ca.dll

windows7_x64

6f7620033e...ca.dll

windows10_x64

Analysis

max time kernel
5s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
20-02-2021 15:51

Sharing

Copy URL

Twitter E-mail

Static task

static1

macro xlm

Behavioral task

behavioral1

Sample

08af4703386cb3cd9728fe81b7c1b5e4621cc476ebc41dc72204d4b98ae2df22.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

08af4703386cb3cd9728fe81b7c1b5e4621cc476ebc41dc72204d4b98ae2df22.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral3

Sample

1a86f37c4830102f274d8d26e167412e5f0d8e82d66008d63066e1c48e285e38.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral4

Sample

1a86f37c4830102f274d8d26e167412e5f0d8e82d66008d63066e1c48e285e38.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral5

Sample

1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral6

Sample

1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

Resource

win10v20201028

lokibot spyware stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral7

Sample

1dda56e38d9187c2f440a838d59474055045bad5791fc75794b1472350e2a328.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral8

Sample

1dda56e38d9187c2f440a838d59474055045bad5791fc75794b1472350e2a328.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral9

Sample

1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

Resource

win7v20201028

agenttesla keylogger spyware stealer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral10

Sample

1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

Resource

win10v20201028

agenttesla keylogger spyware stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral11

Sample

2b08e7b15acdf76390aa499573b76edbdc69617be61a2fbc0536eb24eada0c79.xlsx

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral12

Sample

2b08e7b15acdf76390aa499573b76edbdc69617be61a2fbc0536eb24eada0c79.xlsx

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral13

Sample

3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e.dll

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral14

Sample

3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e.dll

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral15

Sample

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

Resource

win7v20201028

redline agilenet infostealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral16

Sample

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

Resource

win10v20201028

redline agilenet infostealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral17

Sample

4b7659b234e140d7f27e16de31ff5e78d9047d190032aaf4dbfe7684b08f6d63.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral18

Sample

4b7659b234e140d7f27e16de31ff5e78d9047d190032aaf4dbfe7684b08f6d63.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral19

Sample

4bb4e4e1b44c388a8244e7d13a7d68797c5b6cc1cc9d93e2bc16a6b47b929c91.xls

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral20

Sample

4bb4e4e1b44c388a8244e7d13a7d68797c5b6cc1cc9d93e2bc16a6b47b929c91.xls

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral21

Sample

4c4420fc8167dc9d7a4bae0c3fc92ffd5bc3217e0c0eab1ba931cc1930233296.exe

Resource

win7v20201028

lokibot spyware stealer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral22

Sample

4c4420fc8167dc9d7a4bae0c3fc92ffd5bc3217e0c0eab1ba931cc1930233296.exe

Resource

win10v20201028

lokibot spyware stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral23

Sample

4e8b50459a8033a3e81008fe1e01df1997193d59f1012125325ee127281f387d.dll

Resource

win7v20201028

dridex 10444 botnet discovery evasion loader trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral24

Sample

4e8b50459a8033a3e81008fe1e01df1997193d59f1012125325ee127281f387d.dll

Resource

win10v20201028

dridex 10444 botnet discovery evasion loader trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral25

Sample

4ec8577958337ec055aff17e6e41d1bcc3948972d7d60ccaaa4fca91794b85ff.xlsx

Resource

win7v20201028

agenttesla keylogger spyware stealer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral26

Sample

4ec8577958337ec055aff17e6e41d1bcc3948972d7d60ccaaa4fca91794b85ff.xlsx

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral27

Sample

6abf4544f60ac6117706727c241b97924e0c474f505838d0eb0491fc62b673cd.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral28

Sample

6abf4544f60ac6117706727c241b97924e0c474f505838d0eb0491fc62b673cd.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral29

Sample

6f0f5ac2a08c4746186a79f3afe48a614b1ed180ce830058805354bfa8cb1e8e.exe

Resource

win7v20201028

remcos persistence rat

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral30

Sample

6f0f5ac2a08c4746186a79f3afe48a614b1ed180ce830058805354bfa8cb1e8e.exe

Resource

win10v20201028

remcos persistence rat

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral31

Sample

6f7620033e5a6b1283b801c2c97d2bd5dcacb72a2b1ba709b6a763394c6a6aca.dll

Resource

win7v20201028

dridex 10444 botnet discovery evasion loader trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral32

Sample

6f7620033e5a6b1283b801c2c97d2bd5dcacb72a2b1ba709b6a763394c6a6aca.dll

Resource

win10v20201028

dridex 10444 botnet discovery evasion loader trojan

windows10_x64

0 signatures

0 seconds

Report Analysis Logs

General

Target

3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e.dll
Size

180KB
MD5

7831a9eebbb485ab4850460e33185cb3
SHA1

433471495f168d8361971f95fff1a1e78dc1ea81
SHA256

3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e
SHA512

a5c9d45569c09d9022ee8545e761ab1803ae994255f466e57d588fe51cf1517586f227f5b568361b3cc42bcc2f1dc04d8bae7ea2d7836ea2d00f62500add6f7c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1932 wrote to memory of 1920	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e.dll,#1
  2⤵
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-2-0x0000000000000000-mapping.dmp

Download
memory/1920-3-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download