Analysis
-
max time kernel
19s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-12-2022 08:44
Static task
static1
Behavioral task
behavioral1
Sample
a619132e7c61432841de11c8116c4644.dll
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
-
Target
a619132e7c61432841de11c8116c4644.dll
-
Size
6.3MB
-
MD5
a619132e7c61432841de11c8116c4644
-
SHA1
49d002da4c23840cd4d55918946980645b384fdc
-
SHA256
a98b0087e10d01411982e9539ff9e6185242c8c7af6229895bb844f8aaf9f73e
-
SHA512
3091ada2431b96f73f5a301d22a58439dff3c166946568015a0612b25258ffe0e44251e82ffb01be945e7682bc663e5697497883fc1b9ba98b1910f908cc0720
-
SSDEEP
196608:9Ig2+sNg8zhZQHukk9VFO3OuUXvVgW/hRiTzfyrvF:9Xreg8lZQHT3w/2ChRofyrv
Malware Config
Extracted
Family
systembc
C2
89.22.236.225:4193
176.124.205.5:4193
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 1 1208 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
rundll32.exepid process 1208 rundll32.exe 1208 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 1208 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-54-0x000007FEF5580000-0x000007FEF5F84000-memory.dmpFilesize
10.0MB