Overview
overview
10Static
static
4LarvaLabsW...er.exe
windows7_x64
10LarvaLabsW...er.exe
windows10_x64
10ROGAIOSDK.dll
windows7_x64
3ROGAIOSDK.dll
windows10_x64
3RofPaketsoka.dll
windows7_x64
1RofPaketsoka.dll
windows10_x64
3ssleay32.dll
windows7_x64
1ssleay32.dll
windows10_x64
1storarc.dll
windows7_x64
1storarc.dll
windows10_x64
1storelib.dll
windows7_x64
1storelib.dll
windows10_x64
3storelibir-2.dll
windows7_x64
1storelibir-2.dll
windows10_x64
3Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-12-2021 16:12
Behavioral task
behavioral1
Sample
LarvaLabsWallet Launcher.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
LarvaLabsWallet Launcher.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
ROGAIOSDK.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
ROGAIOSDK.dll
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
RofPaketsoka.dll
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
RofPaketsoka.dll
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
ssleay32.dll
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
ssleay32.dll
Resource
win10-en-20211208
Behavioral task
behavioral9
Sample
storarc.dll
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
storarc.dll
Resource
win10-en-20211208
Behavioral task
behavioral11
Sample
storelib.dll
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
storelib.dll
Resource
win10-en-20211208
Behavioral task
behavioral13
Sample
storelibir-2.dll
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
storelibir-2.dll
Resource
win10-en-20211208
General
-
Target
RofPaketsoka.dll
-
Size
260KB
-
MD5
bc65564fe8430d684cc54b5c1ab8f012
-
SHA1
b75e38d7dd58f351bfb2d64333f6bafa20d2f199
-
SHA256
f2871ca7c3a685006df8d50ce7707a0eb2850e0c9de74c2a3c19c3693623bef8
-
SHA512
2ef56b15f12f717541c81e988e400c1e2b8ffe1bb650415f89e425aad5a1ad413182357c4a427b7ba94351433e7bc2a5f5962f584235de7417f099c7ff5baed4
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1832 wrote to memory of 1984 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 1984 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 1984 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 1984 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 1984 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 1984 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 1984 1832 rundll32.exe rundll32.exe