Overview
overview
10Static
static
snxdx/????.url
windows7_x64
6snxdx/????.url
windows10-2004_x64
6snxdx/?????.exe
windows7_x64
1snxdx/?????.exe
windows10-2004_x64
1snxdx/??????.url
windows7_x64
6snxdx/??????.url
windows10-2004_x64
6snxdx/Crac...PI.dll
windows7_x64
10snxdx/Crac...PI.dll
windows10-2004_x64
10snxdx/UUWi...er.dll
windows7_x64
1snxdx/UUWi...er.dll
windows10-2004_x64
3snxdx/dc.dll
windows7_x64
8snxdx/dc.dll
windows10-2004_x64
8snxdx/msvcr120.dll
windows7_x64
3snxdx/msvcr120.dll
windows10-2004_x64
3Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:06
Static task
static1
Behavioral task
behavioral1
Sample
snxdx/????.url
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
snxdx/????.url
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
snxdx/?????.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
snxdx/?????.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
snxdx/??????.url
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
snxdx/??????.url
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
snxdx/CrackCaptchaAPI.dll
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
snxdx/CrackCaptchaAPI.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
snxdx/UUWiseHelper.dll
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
snxdx/UUWiseHelper.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
snxdx/dc.dll
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
snxdx/dc.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
snxdx/msvcr120.dll
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
snxdx/msvcr120.dll
Resource
win10v2004-20220414-en
General
-
Target
snxdx/dc.dll
-
Size
112KB
-
MD5
3a7c7fb54091111e3ed61720e2c3099e
-
SHA1
c6bae31d03e2ef65145f7e9cbbcf93213893f49a
-
SHA256
2de070429883532cc23061bcec1dc2b05c9e57ddec7b28ed14499e8829c9ca8e
-
SHA512
54739aeb81fdcb0608d6a8579f2fa478d75a1908e2ff115bab91062977470361b142854153970de5333f2f106eb86c07aaeb9956928866aefed41b7c1a803f67
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 6 5108 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1316 5108 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 64 wrote to memory of 5108 64 rundll32.exe rundll32.exe PID 64 wrote to memory of 5108 64 rundll32.exe rundll32.exe PID 64 wrote to memory of 5108 64 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\snxdx\dc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\snxdx\dc.dll,#12⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 8883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5108 -ip 51081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5108-130-0x0000000000000000-mapping.dmp