cad0e84b5c7a0aa2f60edecd9edd8a0db0fcdf439de63db7f1a4a06f3ebcf09e | Triage

Resubmissions

31-03-2023 23:15

230331-28yt3sec63 6

31-03-2023 23:09

230331-25cgnsec34 6

Analysis

max time kernel
90s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 23:09

Sharing

Report Analysis Logs

General

Target

IGG-REDCON.v1.3.0/SmartSteamEmu.dll
Size

4.8MB
MD5

ea60af14fd983c6ed4c410ef1c4895a4
SHA1

cfca46eacb8cdc23634ffd47488cc0bf81ffdd6d
SHA256

57d75a31a2e70b55122427a2ccfb5c23d69e2cc239447924f0a245faf0db0020
SHA512

373992e51d959ac3c19b8b2956513024705b672b41765f1888f874662fd25c9ac8f57326e5d6d0f64affb3f7cc212cc4ea83984bf02603a1508c72c7e666eea6
SSDEEP

98304:cbvdZ9l4aC03V5jXc7dus/ik7BjTT8qE:CjxC0sduOMq

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

rundll32.exe

pid	process
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2056 wrote to memory of 1316	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 1316	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 1316	2056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-133-0x00000000020C0000-0x00000000020D0000-memory.dmp

Filesize
64KB

Download