Analysis

  • max time kernel
    103s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2022 20:33

General

  • Target

    4123.do1.dll

  • Size

    48KB

  • MD5

    f776deb4df137b37dcae5406c8f3a07a

  • SHA1

    f6a31b594fca39c118927405fa4d14353b8fd49a

  • SHA256

    93cc5e6a6b671d9b0124ade32ae8b09269de9f03c5c5e66347fbfc7a8c3b305e

  • SHA512

    4077b4214b4683bb4776d470027e61fcc3cb3e78beb9377674e4a4de9115d52911e39cb29a566ab446c6962a252ce01020ffd616b5854a9d8230414262bfafe2

  • SSDEEP

    768:fw2jnhaqqUgQeONXr27iLAkfP69FyfQZWBS:hjnEQeON727CA2G

Score
10/10

Malware Config

Signatures

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

  • Nloader payload 4 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4123.do1.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4123.do1.dll,#1
      2⤵
        PID:424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 904
          3⤵
          • Program crash
          PID:3548
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 424 -ip 424
      1⤵
        PID:2812

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/424-132-0x0000000000000000-mapping.dmp
      • memory/424-133-0x00000000014E0000-0x00000000014E9000-memory.dmp
        Filesize

        36KB

      • memory/424-137-0x0000000002FE0000-0x0000000002FE7000-memory.dmp
        Filesize

        28KB

      • memory/424-140-0x0000000003000000-0x0000000003005000-memory.dmp
        Filesize

        20KB

      • memory/424-143-0x00000000014B0000-0x00000000014B6000-memory.dmp
        Filesize

        24KB