Analysis
- max time kernel
125s - max time network
47s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
04/12/2022, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
- Size 376KB
- Sample221204-rfv8daaf9x
- SHA256 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b
- MD5 4d1d55a40680b9bd9914535eb9a03487
- SHA1 4a6891c653054c3b0d46772b38d1bbaa88d3f3d8
- SHA512 26be11ea4c98ebb9b9b096c9a98d6d83698c7cccb777a1a607c915ca01547644f6aa5c031d470fd0c4f764250d2885c4826224ecebe0ab2f78aa2cad67bf5538
- SSDEEP 3072:gPF9AomKoezHosdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g0J:gd9lXA5nlHVoqd9iXuMgRNMK
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 2028 rundll32.exe 2028 rundll32.exe 2028 rundll32.exe 2028 rundll32.exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\flive.dll c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\RCXFCD8.tmp c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\RCXFCDA.tmp c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\RCXFCEB.tmp c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\RCXFCEC.tmp c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\RCX180.tmp c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\RCXFCC7.tmp c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\RCXFCC8.tmp c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\slive.exe c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\RCXFCD9.tmp c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\searchlive.dll c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe File opened for modification C:\Windows\SysWOW64\RCX17F.tmp c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2028 2004 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe 27 PID 2004 wrote to memory of 2028 2004 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe 27 PID 2004 wrote to memory of 2028 2004 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe 27 PID 2004 wrote to memory of 2028 2004 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe 27 PID 2004 wrote to memory of 2028 2004 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe 27 PID 2004 wrote to memory of 2028 2004 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe 27 PID 2004 wrote to memory of 2028 2004 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe"C:\Users\Admin\AppData\Local\Temp\c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\rundll32.exe"rundll32.exe" searchlive.dll,DllUnregisterServer2⤵
- Loads dropped DLL
PID:2028
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\flive.dll
- Size 388KB
- SHA256 0969c655781c8b42218e8ce9270a663fb419600d02cb1e90dec576b795a979d8
- MD5 cc85e09aa847d86feeaa142abfe0c33f
- SHA1 7abd1db0fe201976401fdbc3bca2590a23525c39
- SHA512 7680c431249656c58dfe20a35969de8170ab7beb33dcae39a5d3fc7145f45be44d570639272aad5ff429379d4e076f50793d09cb3ce5848081eebdcc0150317a
- SSDEEP 3072:jmHHvsanYKmo9V1dmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67gvI:+5nlHV1A5nlHVoqd9iXuMgRNM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\searchlive.dll
- Size 372KB
- SHA256 063e4ee176e8e45a377ba826284ae949032c0a258bf0d7132ab95ec1d77426c7
- MD5 ede1e4d7eab39722b2c100a6542067f8
- SHA1 015c370cf00b801818c20dc266211ccc4348a778
- SHA512 ff958fd3f825483d0e0ed9c0444ee155c7f9c94e42b77614f8e2d6dabb0fecf17912603baa96c58615920d4885e108a75f41ff00109c56f0bb0b6c330396a5cd
- SSDEEP 3072:GGR5eKsBoVVdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g7+:GMgR+A5nlHVoqd9iXuMgRNMK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\slive.exe
- Size 376KB
- SHA256 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b
- MD5 4d1d55a40680b9bd9914535eb9a03487
- SHA1 4a6891c653054c3b0d46772b38d1bbaa88d3f3d8
- SHA512 26be11ea4c98ebb9b9b096c9a98d6d83698c7cccb777a1a607c915ca01547644f6aa5c031d470fd0c4f764250d2885c4826224ecebe0ab2f78aa2cad67bf5538
- SSDEEP 3072:gPF9AomKoezHosdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g0J:gd9lXA5nlHVoqd9iXuMgRNMK
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\searchlive.dll
- Size 372KB
- SHA256 063e4ee176e8e45a377ba826284ae949032c0a258bf0d7132ab95ec1d77426c7
- MD5 ede1e4d7eab39722b2c100a6542067f8
- SHA1 015c370cf00b801818c20dc266211ccc4348a778
- SHA512 ff958fd3f825483d0e0ed9c0444ee155c7f9c94e42b77614f8e2d6dabb0fecf17912603baa96c58615920d4885e108a75f41ff00109c56f0bb0b6c330396a5cd
- SSDEEP 3072:GGR5eKsBoVVdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g7+:GMgR+A5nlHVoqd9iXuMgRNMK
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\searchlive.dll
- Size 372KB
- SHA256 063e4ee176e8e45a377ba826284ae949032c0a258bf0d7132ab95ec1d77426c7
- MD5 ede1e4d7eab39722b2c100a6542067f8
- SHA1 015c370cf00b801818c20dc266211ccc4348a778
- SHA512 ff958fd3f825483d0e0ed9c0444ee155c7f9c94e42b77614f8e2d6dabb0fecf17912603baa96c58615920d4885e108a75f41ff00109c56f0bb0b6c330396a5cd
- SSDEEP 3072:GGR5eKsBoVVdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g7+:GMgR+A5nlHVoqd9iXuMgRNMK
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\searchlive.dll
- Size 372KB
- SHA256 063e4ee176e8e45a377ba826284ae949032c0a258bf0d7132ab95ec1d77426c7
- MD5 ede1e4d7eab39722b2c100a6542067f8
- SHA1 015c370cf00b801818c20dc266211ccc4348a778
- SHA512 ff958fd3f825483d0e0ed9c0444ee155c7f9c94e42b77614f8e2d6dabb0fecf17912603baa96c58615920d4885e108a75f41ff00109c56f0bb0b6c330396a5cd
- SSDEEP 3072:GGR5eKsBoVVdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g7+:GMgR+A5nlHVoqd9iXuMgRNMK
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\searchlive.dll
- Size 372KB
- SHA256 063e4ee176e8e45a377ba826284ae949032c0a258bf0d7132ab95ec1d77426c7
- MD5 ede1e4d7eab39722b2c100a6542067f8
- SHA1 015c370cf00b801818c20dc266211ccc4348a778
- SHA512 ff958fd3f825483d0e0ed9c0444ee155c7f9c94e42b77614f8e2d6dabb0fecf17912603baa96c58615920d4885e108a75f41ff00109c56f0bb0b6c330396a5cd
- SSDEEP 3072:GGR5eKsBoVVdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g7+:GMgR+A5nlHVoqd9iXuMgRNMK
- MD5 SHA1 SHA512 SSDEEP