Overview
overview
3Static
static
freebl3.dll
windows7_x64
1freebl3.dll
windows10_x64
1mozglue.dll
windows7_x64
3mozglue.dll
windows10_x64
3msvcp140.dll
windows7_x64
3msvcp140.dll
windows10_x64
3nss3.dll
windows7_x64
1nss3.dll
windows10_x64
3softokn3.dll
windows7_x64
3softokn3.dll
windows10_x64
3sqlite3.dll
windows7_x64
3sqlite3.dll
windows10_x64
3vcruntime140.dll
windows7_x64
3vcruntime140.dll
windows10_x64
3Analysis
-
max time kernel
112s -
max time network
46s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
08-08-2021 19:10
Static task
static1
Behavioral task
behavioral1
Sample
freebl3.dll
Resource
win7v20210408
Behavioral task
behavioral2
Sample
freebl3.dll
Resource
win10v20210410
Behavioral task
behavioral3
Sample
mozglue.dll
Resource
win7v20210408
Behavioral task
behavioral4
Sample
mozglue.dll
Resource
win10v20210410
Behavioral task
behavioral5
Sample
msvcp140.dll
Resource
win7v20210408
Behavioral task
behavioral6
Sample
msvcp140.dll
Resource
win10v20210410
Behavioral task
behavioral7
Sample
nss3.dll
Resource
win7v20210410
Behavioral task
behavioral8
Sample
nss3.dll
Resource
win10v20210408
Behavioral task
behavioral9
Sample
softokn3.dll
Resource
win7v20210410
Behavioral task
behavioral10
Sample
softokn3.dll
Resource
win10v20210408
Behavioral task
behavioral11
Sample
sqlite3.dll
Resource
win7v20210410
Behavioral task
behavioral12
Sample
sqlite3.dll
Resource
win10v20210408
Behavioral task
behavioral13
Sample
vcruntime140.dll
Resource
win7v20210410
Behavioral task
behavioral14
Sample
vcruntime140.dll
Resource
win10v20210410
General
-
Target
sqlite3.dll
-
Size
630KB
-
MD5
e477a96c8f2b18d6b5c27bde49c990bf
-
SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409
-
SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
-
SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1984 1956 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1984 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1984 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1816 wrote to memory of 1956 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1956 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1956 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1956 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1956 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1956 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1956 1816 rundll32.exe rundll32.exe PID 1956 wrote to memory of 1984 1956 rundll32.exe WerFault.exe PID 1956 wrote to memory of 1984 1956 rundll32.exe WerFault.exe PID 1956 wrote to memory of 1984 1956 rundll32.exe WerFault.exe PID 1956 wrote to memory of 1984 1956 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sqlite3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sqlite3.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 2283⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken