Analysis
-
max time kernel
41s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11-12-2022 08:45
Static task
static1
Behavioral task
behavioral1
Sample
cd64b19f5bfb0e2f356b66d8c3925245.dll
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
General
-
Target
cd64b19f5bfb0e2f356b66d8c3925245.dll
-
Size
6.4MB
-
MD5
cd64b19f5bfb0e2f356b66d8c3925245
-
SHA1
1aadd24d193dd1bf2cf5e3dff9c0125eebce08bf
-
SHA256
af8890c3a9430938483b741df88f6806b25f6723713f978aaefb4a8989d6aca9
-
SHA512
75ff426466e80ec639add03def89b2d585c864920fbc3c90a7f0f98e08b4faae7daec2ac299bbd25d0afe11e987b78451c6760c01d12a57b883d4ac8235f6251
-
SSDEEP
196608:wLu+Yq8Kmrd6Lc1p9vC3g8+eeULSBHDmbr0W9lGr24G:wvYlgIU3g8LjLgutz
Malware Config
Extracted
Family
systembc
C2
89.22.236.225:4193
176.124.205.5:4193
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 1 1220 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
rundll32.exepid process 1220 rundll32.exe 1220 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 1220 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-54-0x000007FEF52A0000-0x000007FEF5CBA000-memory.dmpFilesize
10.1MB