Overview
overview
10Static
static
10Wolfteam/Hack.exe
windows7_x64
10Wolfteam/Hack.exe
windows10_x64
10Wolfteam/S...RT.dll
windows7_x64
Wolfteam/S...RT.dll
windows10_x64
Wolfteam/a..._0.dll
windows7_x64
Wolfteam/a..._0.dll
windows10_x64
Wolfteam/a..._0.dll
windows7_x64
Wolfteam/a..._0.dll
windows10_x64
Wolfteam/a..._0.dll
windows7_x64
Wolfteam/a..._0.dll
windows10_x64
Wolfteam/a..._0.dll
windows7_x64
1Wolfteam/a..._0.dll
windows10_x64
1Wolfteam/python27.dll
windows7_x64
Wolfteam/python27.dll
windows10_x64
Analysis
-
max time kernel
13s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25-03-2021 22:00
Behavioral task
behavioral1
Sample
Wolfteam/Hack.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Wolfteam/Hack.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Wolfteam/SpeedTreeRT.dll
Resource
win7v20201028
Behavioral task
behavioral4
Sample
Wolfteam/SpeedTreeRT.dll
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Wolfteam/api_ms_win_core_interlocked_l1_1_0.dll
Resource
win7v20201028
Behavioral task
behavioral6
Sample
Wolfteam/api_ms_win_core_interlocked_l1_1_0.dll
Resource
win10v20201028
Behavioral task
behavioral7
Sample
Wolfteam/api_ms_win_core_synch_l1_1_0.dll
Resource
win7v20201028
Behavioral task
behavioral8
Sample
Wolfteam/api_ms_win_core_synch_l1_1_0.dll
Resource
win10v20201028
Behavioral task
behavioral9
Sample
Wolfteam/api_ms_win_core_timezone_l1_1_0.dll
Resource
win7v20201028
Behavioral task
behavioral10
Sample
Wolfteam/api_ms_win_core_timezone_l1_1_0.dll
Resource
win10v20201028
Behavioral task
behavioral11
Sample
Wolfteam/api_ms_win_crt_locale_l1_1_0.dll
Resource
win7v20201028
Behavioral task
behavioral12
Sample
Wolfteam/api_ms_win_crt_locale_l1_1_0.dll
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Wolfteam/python27.dll
Resource
win7v20201028
Behavioral task
behavioral14
Sample
Wolfteam/python27.dll
Resource
win10v20201028
General
-
Target
Wolfteam/api_ms_win_crt_locale_l1_1_0.dll
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4640 wrote to memory of 4668 4640 rundll32.exe rundll32.exe PID 4640 wrote to memory of 4668 4640 rundll32.exe rundll32.exe PID 4640 wrote to memory of 4668 4640 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Wolfteam\api_ms_win_crt_locale_l1_1_0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Wolfteam\api_ms_win_crt_locale_l1_1_0.dll,#12⤵PID:4668
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4668-2-0x0000000000000000-mapping.dmp