Overview
overview
10Static
static
bat.zip
windows7-x64
1bat.zip
windows10-2004-x64
118014 Dec 01.lnk
windows7-x64
1018014 Dec 01.lnk
windows10-2004-x64
10587.dll
windows7-x64
1587.dll
windows10-2004-x64
1System Vol...meGuid
windows7-x64
1System Vol...meGuid
windows10-2004-x64
1System Vol...gs.dat
windows7-x64
3System Vol...gs.dat
windows10-2004-x64
3start.bat
windows7-x64
10start.bat
windows10-2004-x64
10Analysis
-
max time kernel
5s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 01:54
Static task
static1
Behavioral task
behavioral1
Sample
bat.zip
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bat.zip
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
18014 Dec 01.lnk
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
18014 Dec 01.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
587.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
587.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
System Volume Information/IndexerVolumeGuid
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
System Volume Information/IndexerVolumeGuid
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
System Volume Information/WPSettings.dat
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
System Volume Information/WPSettings.dat
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
start.bat
Resource
win7-20220901-en
General
-
Target
587.dll
-
Size
600KB
-
MD5
f5e2e5bc6629db401c96da463a1ce7ed
-
SHA1
7485b301c1c405df1fedfb28cedfeb21fb531f17
-
SHA256
456a599f6904b3ce205ff88d015c95f890e6c1b8e9a3177c057bdd4e2358b36c
-
SHA512
2be0087729f422c7c039955cb79a947959e822db583c68aacf5c2f83856977c4dbb51971b19c6bfff620f60bc6e954d5a6a687aae9eb3fa4ec95c4687c7ce461
-
SSDEEP
12288:QSUUEfo5I6/o2qgkpUdQ9Msme0CWUdOWk4F:QSTiWDvLgRme0C0Wk4
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1852 wrote to memory of 1928 1852 rundll32.exe rundll32.exe PID 1852 wrote to memory of 1928 1852 rundll32.exe rundll32.exe PID 1852 wrote to memory of 1928 1852 rundll32.exe rundll32.exe PID 1852 wrote to memory of 1928 1852 rundll32.exe rundll32.exe PID 1852 wrote to memory of 1928 1852 rundll32.exe rundll32.exe PID 1852 wrote to memory of 1928 1852 rundll32.exe rundll32.exe PID 1852 wrote to memory of 1928 1852 rundll32.exe rundll32.exe