Analysis
- max time kernel
103s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
01/10/2022, 20:33
General
- Target 4123.do1.dll
- Size 48KB
- Sample221001-zbveaafffp
- SHA256 93cc5e6a6b671d9b0124ade32ae8b09269de9f03c5c5e66347fbfc7a8c3b305e
Score
10/10
Malware Config
Signatures
- Nloader
Simple loader that includes the keyword 'campo' in the URL used to download other families.
- Nloader payload 4 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4123.do1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4123.do1.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 9043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 424 -ip 4241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/424-133-0x00000000014E0000-0x00000000014E9000-memory.dmp
memory/424-137-0x0000000002FE0000-0x0000000002FE7000-memory.dmp
memory/424-140-0x0000000003000000-0x0000000003005000-memory.dmp
memory/424-143-0x00000000014B0000-0x00000000014B6000-memory.dmp