Overview
overview
9Static
static
Signalis/D...l3.dll
windows10-2004_x64
9Signalis/D...ue.dll
windows10-2004_x64
3Signalis/D...40.dll
windows10-2004_x64
3Signalis/DLC/nss3.dll
windows10-2004_x64
3Signalis/D...n3.dll
windows10-2004_x64
3Signalis/D...e3.dll
windows10-2004_x64
3Signalis/D...40.dll
windows10-2004_x64
3Signalis/Signalis.exe
windows10-2004_x64
8Analysis
-
max time kernel
90s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
05-03-2022 12:59
Static task
static1
Behavioral task
behavioral1
Sample
Signalis/DLC/freebl3.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral2
Sample
Signalis/DLC/mozglue.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral3
Sample
Signalis/DLC/msvcp140.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral4
Sample
Signalis/DLC/nss3.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral5
Sample
Signalis/DLC/softokn3.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral6
Sample
Signalis/DLC/sqlite3.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral7
Sample
Signalis/DLC/vcruntime140.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral8
Sample
Signalis/Signalis.exe
Resource
win10v2004-en-20220113
General
-
Target
Signalis/DLC/nss3.dll
-
Size
1.2MB
-
MD5
bfac4e3c5908856ba17d41edcd455a51
-
SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428
-
SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
-
SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3532 1356 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1360 wrote to memory of 1356 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 1356 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 1356 1360 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Signalis\DLC\nss3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Signalis\DLC\nss3.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 6563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1356 -ip 13561⤵