Analysis
- max time kernel
124s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
26/11/2021, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
besta.ocx.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
besta.ocx.dll
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
- Target besta.ocx.dll
- Size 474KB
- Sample211126-naagyafce5
- SHA256 8d5cf489f219d2edde134f6dacc5d3c4c6a97ce405101a86a0be26f3f8c1c20e
- MD5 d9b8a869e56aae15de8a9158138261da
- SHA1 0df3bcc15d51f3d087153a0478e6b9b2fb22dbe6
- SHA512 713f98c4d567778fb2cfc1418badb88b8b9d4800ce6e8acb83c08521915a1fb8b55116fd4b93ea63bb0f84f167e48dc79ff2461e459c0ca1a9300255d6b86d27
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3240 created 3972 3240 WerFault.exe 69 - Program crash 2 IoCs
pid pid_target Process procid_target 2276 3972 WerFault.exe 69 3240 3972 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 2276 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2276 WerFault.exe Token: SeBackupPrivilege 2276 WerFault.exe Token: SeDebugPrivilege 2276 WerFault.exe Token: SeDebugPrivilege 3240 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2272 wrote to memory of 3972 2272 rundll32.exe 69 PID 2272 wrote to memory of 3972 2272 rundll32.exe 69 PID 2272 wrote to memory of 3972 2272 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll,#12⤵PID:3972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 6083⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 6323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
-