Overview
overview
9Static
static
Signalis/D...l3.dll
windows10_x64
9Signalis/D...l3.dll
windows10-2004_x64
1Signalis/D...ue.dll
windows10_x64
3Signalis/D...ue.dll
windows10-2004_x64
3Signalis/D...40.dll
windows10_x64
3Signalis/D...40.dll
windows10-2004_x64
3Signalis/DLC/nss3.dll
windows10_x64
3Signalis/DLC/nss3.dll
windows10-2004_x64
3Signalis/D...n3.dll
windows10_x64
3Signalis/D...n3.dll
windows10-2004_x64
3Signalis/D...e3.dll
windows10_x64
3Signalis/D...e3.dll
windows10-2004_x64
3Signalis/D...40.dll
windows10_x64
3Signalis/D...40.dll
windows10-2004_x64
3Signalis/Signalis.exe
windows10_x64
8Signalis/Signalis.exe
windows10-2004_x64
8Analysis
-
max time kernel
1632s -
max time network
1429s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
05-03-2022 13:24
Static task
static1
Behavioral task
behavioral1
Sample
Signalis/DLC/freebl3.dll
Resource
win10-20220223-en
Behavioral task
behavioral2
Sample
Signalis/DLC/freebl3.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral3
Sample
Signalis/DLC/mozglue.dll
Resource
win10-20220223-en
Behavioral task
behavioral4
Sample
Signalis/DLC/mozglue.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral5
Sample
Signalis/DLC/msvcp140.dll
Resource
win10-20220223-en
Behavioral task
behavioral6
Sample
Signalis/DLC/msvcp140.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
Signalis/DLC/nss3.dll
Resource
win10-en-20211208
Behavioral task
behavioral8
Sample
Signalis/DLC/nss3.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral9
Sample
Signalis/DLC/softokn3.dll
Resource
win10-en-20211208
Behavioral task
behavioral10
Sample
Signalis/DLC/softokn3.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral11
Sample
Signalis/DLC/sqlite3.dll
Resource
win10-20220223-en
Behavioral task
behavioral12
Sample
Signalis/DLC/sqlite3.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral13
Sample
Signalis/DLC/vcruntime140.dll
Resource
win10-20220223-en
Behavioral task
behavioral14
Sample
Signalis/DLC/vcruntime140.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral15
Sample
Signalis/Signalis.exe
Resource
win10-20220223-en
Behavioral task
behavioral16
Sample
Signalis/Signalis.exe
Resource
win10v2004-en-20220113
General
-
Target
Signalis/DLC/nss3.dll
-
Size
1.2MB
-
MD5
bfac4e3c5908856ba17d41edcd455a51
-
SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428
-
SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
-
SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2524 1820 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1664 wrote to memory of 1820 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1820 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1820 1664 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Signalis\DLC\nss3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Signalis\DLC\nss3.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 6403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1820 -ip 18201⤵