Overview
overview
9Static
static
9�...ad.dll
windows7-x64
1�...ad.dll
windows10-2004-x64
1�...EL.dll
windows7-x64
8�...EL.dll
windows10-2004-x64
8�...er.dll
windows7-x64
1�...er.dll
windows10-2004-x64
3�...p1.dll
windows7-x64
1�...p1.dll
windows10-2004-x64
3�...PI.dll
windows7-x64
1�...PI.dll
windows10-2004-x64
1�...ew.dll
windows7-x64
1�...ew.dll
windows10-2004-x64
1�...nv.dll
windows7-x64
1�...nv.dll
windows10-2004-x64
1�...xt.dll
windows7-x64
1�...xt.dll
windows10-2004-x64
1�...t5.dll
windows7-x64
1�...t5.dll
windows10-2004-x64
1�...et.dll
windows7-x64
1�...et.dll
windows10-2004-x64
1�...ln.dll
windows7-x64
1�...ln.dll
windows10-2004-x64
1�...ec.dll
windows7-x64
1�...ec.dll
windows10-2004-x64
1�...��.htm
windows7-x64
1�...��.htm
windows10-2004-x64
1�...��.exe
windows7-x64
5�...��.exe
windows10-2004-x64
5Analysis
-
max time kernel
178s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 21:55
Behavioral task
behavioral1
Sample
Ծע/EThread.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Ծע/EThread.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Ծע/SkinH_EL.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Ծע/SkinH_EL.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
Ծע/UUWiseHelper.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Ծע/UUWiseHelper.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Ծע/dp1.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Ծע/dp1.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Ծע/eAPI.dll
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
Ծע/eAPI.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Ծע/ethreadnew.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
Ծע/ethreadnew.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
Ծע/iconv.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Ծע/iconv.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Ծע/iext.dll
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
Ծע/iext.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Ծע/iext5.dll
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
Ծע/iext5.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
Ծע/internet.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Ծע/internet.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
Ծע/krnln.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
Ծע/krnln.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
Ծע/spec.dll
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
Ծע/spec.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
Ծע/˵.htm
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
Ծע/˵.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
Ծע/Ծע.exe
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
Ծע/Ծע.exe
Resource
win10v2004-20220812-en
General
-
Target
Ծע/SkinH_EL.dll
-
Size
86KB
-
MD5
147127382e001f495d1842ee7a9e7912
-
SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
-
SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
-
SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d
-
SSDEEP
1536:s5Np2dgZgIehUUS3E1Ujmrvl179D53UWnGQRJZiXRmrCnKptnouy8K:s5Np2dlUX0+Cx17F8QRJZKmOK3outK
Malware Config
Signatures
-
resource yara_rule behavioral4/memory/3520-133-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral4/memory/3520-134-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1816 3520 WerFault.exe 83 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3520 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 964 wrote to memory of 3520 964 rundll32.exe 83 PID 964 wrote to memory of 3520 964 rundll32.exe 83 PID 964 wrote to memory of 3520 964 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\SkinH_EL.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\SkinH_EL.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:3520 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 6443⤵
- Program crash
PID:1816
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3520 -ip 35201⤵PID:3180