253de8145c186c3d3ff60304eab1f23f4fdd50eb38a212c94847578226af433c

Submit
Reports

Overview

overview

Static

static

080540b15c...f5.exe

windows7_x64

080540b15c...f5.exe

windows10_x64

16937c50e9...9a.exe

windows7_x64

16937c50e9...9a.exe

windows10_x64

2fc4602468...5b.exe

windows7_x64

2fc4602468...5b.exe

windows10_x64

2fd826bdb8...14.exe

windows7_x64

2fd826bdb8...14.exe

windows10_x64

cool summer.exe

windows7_x64

cool summer.exe

windows10_x64

iext3.fne.dll

windows7_x64

iext3.fne.dll

windows10_x64

krnln.fnr.dll

windows7_x64

krnln.fnr.dll

windows10_x64

xplib.fne.dll

windows7_x64

xplib.fne.dll

windows10_x64

4373d18b2b...83.exe

windows7_x64

4373d18b2b...83.exe

windows10_x64

485e37b429...f9.exe

windows7_x64

485e37b429...f9.exe

windows10_x64

59c049de6d...14.exe

windows7_x64

59c049de6d...14.exe

windows10_x64

641da56f29...fc.exe

windows7_x64

641da56f29...fc.exe

windows10_x64

64b4fe7baf...60.exe

windows7_x64

64b4fe7baf...60.exe

windows10_x64

74368a064e...e0.exe

windows7_x64

74368a064e...e0.exe

windows10_x64

c087a84574...ce.exe

windows7_x64

c087a84574...ce.exe

windows10_x64

90eca63d6a...52.exe

windows7_x64

90eca63d6a...52.exe

windows10_x64

Analysis

max time kernel
6s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 23:08

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx aspackv2

Behavioral task

behavioral1

Sample

080540b15c90a082697cfa8fa08e0d31ab4e8d12035b69df52a71da41f5e7bf5.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

080540b15c90a082697cfa8fa08e0d31ab4e8d12035b69df52a71da41f5e7bf5.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral3

Sample

16937c50e9597e6d3ce66dc15632eee53ad10c32bb077d53baf0c4368b8a359a.exe

Resource

win7v20201028

bootkit evasion persistence trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral4

Sample

16937c50e9597e6d3ce66dc15632eee53ad10c32bb077d53baf0c4368b8a359a.exe

Resource

win10v20201028

bootkit evasion persistence trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral5

Sample

2fc4602468f243f742b496683ee9bd6ff22c4c85b56567eff3df2bf7ef5c495b.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral6

Sample

2fc4602468f243f742b496683ee9bd6ff22c4c85b56567eff3df2bf7ef5c495b.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral7

Sample

2fd826bdb83c394de8e5c660cb4af4885e071c96db236e80503b3c4ef048b414.exe

Resource

win7v20201028

upx

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral8

Sample

2fd826bdb83c394de8e5c660cb4af4885e071c96db236e80503b3c4ef048b414.exe

Resource

win10v20201028

upx

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral9

Sample

cool summer.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral10

Sample

cool summer.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral11

Sample

iext3.fne.dll

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral12

Sample

iext3.fne.dll

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral13

Sample

krnln.fnr.dll

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral14

Sample

krnln.fnr.dll

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral15

Sample

xplib.fne.dll

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral16

Sample

xplib.fne.dll

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral17

Sample

4373d18b2bf09478387fc4e762cf29d6a9ba886e2f39dd4353fb6e8b33fee083.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral18

Sample

4373d18b2bf09478387fc4e762cf29d6a9ba886e2f39dd4353fb6e8b33fee083.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral19

Sample

485e37b429bee1807d1cc52afa3de654928bd2a17f71b028abe71b1abac7e3f9.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral20

Sample

485e37b429bee1807d1cc52afa3de654928bd2a17f71b028abe71b1abac7e3f9.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral21

Sample

59c049de6d7f42e5739b586fe1fe0dff6318328555f82a71080d03763d08d314.exe

Resource

win7v20201028

upx

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral22

Sample

59c049de6d7f42e5739b586fe1fe0dff6318328555f82a71080d03763d08d314.exe

Resource

win10v20201028

upx

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral23

Sample

641da56f29c645a544f19c88f54c1dfcf3a7f52711c5b0ff8826cf36bbaef3fc.exe

Resource

win7v20201028

discovery evasion

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral24

Sample

641da56f29c645a544f19c88f54c1dfcf3a7f52711c5b0ff8826cf36bbaef3fc.exe

Resource

win10v20201028

discovery evasion persistence

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral25

Sample

64b4fe7baf53d40ac6ab1fd13bdcedb48f38b37c76d792b93da00bc3ba195260.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral26

Sample

64b4fe7baf53d40ac6ab1fd13bdcedb48f38b37c76d792b93da00bc3ba195260.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral27

Sample

74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral28

Sample

74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral29

Sample

c087a84574092eba9510c17f425853ce.exe

Resource

win7v20201028

persistence

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral30

Sample

c087a84574092eba9510c17f425853ce.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral31

Sample

90eca63d6ac05c375af58247435cea9fa724335f946e4576986a25a553dcb852.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral32

Sample

90eca63d6ac05c375af58247435cea9fa724335f946e4576986a25a553dcb852.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Report Analysis Logs

General

Target

xplib.fne.dll
Size

48KB
MD5

37a58e1c5ce48e401ee8dd1d1da54814
SHA1

a87d00d78838c2d968b72330ee6f21f69b2caae5
SHA256

1c426928fb90bedb31fcffa0f3fbe7bdbca4259f93f5abdefed6a9a089f2982c
SHA512

e85052fc305040bdcaf47262e0ce6eef0848b319baac72a076dc94e7d20ea7ad8fbdd7d5381606a3154ab84fe81429bb339123ac1cd94551b1dc9cecfb7a08bf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1260	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1260	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1260	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1260	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1260	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1260	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1260	1832	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xplib.fne.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xplib.fne.dll,#1
2⤵
PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-2-0x0000000000000000-mapping.dmp

Download
memory/1260-3-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download