8050946d45275d1d9a207b61e1e7c69f906193fe120b111497bb15960f9ca379

Submit
Reports

Overview

overview

Static

static

Fri191454c4b4.exe

windows7_x64

Fri191454c4b4.exe

windows10_x64

Fri1921f7a9d3.exe

windows7_x64

Fri1921f7a9d3.exe

windows10_x64

Fri192902b3c24.exe

windows7_x64

Fri192902b3c24.exe

windows10_x64

Fri192b9eeaa03b.exe

windows7_x64

Fri192b9eeaa03b.exe

windows10_x64

Fri192c305b4a.exe

windows7_x64

Fri192c305b4a.exe

windows10_x64

Fri192f077...dd.exe

windows7_x64

Fri192f077...dd.exe

windows10_x64

Fri195cd4d...97.exe

windows7_x64

Fri195cd4d...97.exe

windows10_x64

Fri19870e2...44.exe

windows7_x64

Fri19870e2...44.exe

windows10_x64

Fri19927b4...d1.exe

windows7_x64

Fri19927b4...d1.exe

windows10_x64

Fri19ca03f05489b.exe

windows7_x64

Fri19ca03f05489b.exe

windows10_x64

Fri19d30056588.exe

windows7_x64

Fri19d30056588.exe

windows10_x64

libcurl.dll

windows7_x64

libcurl.dll

windows10_x64

libcurlpp.dll

windows7_x64

libcurlpp.dll

windows10_x64

libgcc_s_dw2-1.dll

windows7_x64

libgcc_s_dw2-1.dll

windows10_x64

libstdc++-6.dll

windows7_x64

libstdc++-6.dll

windows10_x64

libwinpthread-1.dll

windows7_x64

libwinpthread-1.dll

windows10_x64

Analysis

max time kernel
111s
max time network
146s
platform
windows10_x64
resource
win10-en
submitted
10-09-2021 21:28

Sharing

Copy URL

Twitter E-mail

Static task

static1

aspackv2 socelars

Behavioral task

behavioral1

Sample

Fri191454c4b4.exe

Resource

win7v20210408

discovery persistence spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

Fri191454c4b4.exe

Resource

win10-en

discovery persistence spyware stealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral3

Sample

Fri1921f7a9d3.exe

Resource

win7v20210408

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral4

Sample

Fri1921f7a9d3.exe

Resource

win10-en

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral5

Sample

Fri192902b3c24.exe

Resource

win7-en

vidar 706 stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral6

Sample

Fri192902b3c24.exe

Resource

win10v20210408

vidar 706 discovery spyware stealer suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral7

Sample

Fri192b9eeaa03b.exe

Resource

win7-en

discovery evasion persistence

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral8

Sample

Fri192b9eeaa03b.exe

Resource

win10v20210408

discovery evasion persistence

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral9

Sample

Fri192c305b4a.exe

Resource

win7-en

redline jane06 discovery infostealer persistence spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral10

Sample

Fri192c305b4a.exe

Resource

win10v20210408

redline jane06 discovery infostealer persistence spyware stealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral11

Sample

Fri192f077acf656dd.exe

Resource

win7-en

glupteba metasploit xmrig backdoor dropper loader miner trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral12

Sample

Fri192f077acf656dd.exe

Resource

win10-en

glupteba metasploit xmrig backdoor dropper loader miner trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral13

Sample

Fri195cd4dbfdf37897.exe

Resource

win7v20210408

redline xmrig test zzzzz discovery evasion infostealer miner spyware stealer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral14

Sample

Fri195cd4dbfdf37897.exe

Resource

win10-en

netsupport redline xmrig test zzzzz discovery evasion infostealer miner persistence rat spyware stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral15

Sample

Fri19870e2febf5544.exe

Resource

win7v20210408

djvu raccoon redline smokeloader vidar 517 backdoor discovery infostealer persistence ransomware spyware stealer suricata trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral16

Sample

Fri19870e2febf5544.exe

Resource

win10-en

djvu raccoon redline smokeloader vidar 517 backdoor discovery evasion infostealer persistence ransomware spyware stealer suricata themida trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral17

Sample

Fri19927b4fe38a9d1.exe

Resource

win7v20210408

redline pab123 discovery infostealer spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral18

Sample

Fri19927b4fe38a9d1.exe

Resource

win10-en

redline pab123 discovery infostealer spyware stealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral19

Sample

Fri19ca03f05489b.exe

Resource

win7-en

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral20

Sample

Fri19ca03f05489b.exe

Resource

win10v20210408

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral21

Sample

Fri19d30056588.exe

Resource

win7-en

socelars discovery spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral22

Sample

Fri19d30056588.exe

Resource

win10v20210408

socelars spyware stealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral23

Sample

libcurl.dll

Resource

win7-en

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral24

Sample

libcurl.dll

Resource

win10v20210408

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral25

Sample

libcurlpp.dll

Resource

win7-en

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral26

Sample

libcurlpp.dll

Resource

win10v20210408

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral27

Sample

libgcc_s_dw2-1.dll

Resource

win7-en

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral28

Sample

libgcc_s_dw2-1.dll

Resource

win10-en

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral29

Sample

libstdc++-6.dll

Resource

win7v20210408

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral30

Sample

libstdc++-6.dll

Resource

win10-en

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral31

Sample

libwinpthread-1.dll

Resource

win7v20210408

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral32

Sample

libwinpthread-1.dll

Resource

win10-en

windows10_x64

0 signatures

0 seconds

Report Analysis Logs

General

Target

libwinpthread-1.dll
Size

69KB
MD5

1e0d62c34ff2e649ebc5c372065732ee
SHA1

fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256

509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512

3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3660 wrote to memory of 4028	3660	rundll32.exe	rundll32.exe
PID 3660 wrote to memory of 4028	3660	rundll32.exe	rundll32.exe
PID 3660 wrote to memory of 4028	3660	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll,#1
2⤵
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-115-0x0000000000000000-mapping.dmp

Download
memory/4028-117-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4028-116-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4028-119-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4028-118-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download