Overview
overview
10Static
static
4LarvaLabsW...er.exe
windows7_x64
10LarvaLabsW...er.exe
windows10_x64
10ROGAIOSDK.dll
windows7_x64
3ROGAIOSDK.dll
windows10_x64
3RofPaketsoka.dll
windows7_x64
1RofPaketsoka.dll
windows10_x64
3ssleay32.dll
windows7_x64
1ssleay32.dll
windows10_x64
1storarc.dll
windows7_x64
1storarc.dll
windows10_x64
1storelib.dll
windows7_x64
1storelib.dll
windows10_x64
3storelibir-2.dll
windows7_x64
1storelibir-2.dll
windows10_x64
3Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-12-2021 16:12
Behavioral task
behavioral1
Sample
LarvaLabsWallet Launcher.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
LarvaLabsWallet Launcher.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
ROGAIOSDK.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
ROGAIOSDK.dll
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
RofPaketsoka.dll
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
RofPaketsoka.dll
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
ssleay32.dll
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
ssleay32.dll
Resource
win10-en-20211208
Behavioral task
behavioral9
Sample
storarc.dll
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
storarc.dll
Resource
win10-en-20211208
Behavioral task
behavioral11
Sample
storelib.dll
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
storelib.dll
Resource
win10-en-20211208
Behavioral task
behavioral13
Sample
storelibir-2.dll
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
storelibir-2.dll
Resource
win10-en-20211208
General
-
Target
ssleay32.dll
-
Size
160KB
-
MD5
90c56365f4f7b10c7cd79d109202a9f9
-
SHA1
41c3189dd7b95da8f83543cc35bba4393072d410
-
SHA256
ea841a1081508db0599d8e8a418af9af905481d392d7225ca8577f991233b5d6
-
SHA512
fafe4a2b67727ca7eeb635772fe790493586ca65b1561e69168e315622150fe1d61579e59758a1e262fdf72da191b36ac784b1f24690d867177ecc5dc93ac3ec
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 480 wrote to memory of 1652 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1652 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1652 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1652 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1652 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1652 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1652 480 rundll32.exe rundll32.exe