Overview
overview
3Static
static
1HTCTL32.dll
windows7-x64
1HTCTL32.dll
windows10-2004-x64
3PCICHEK.dll
windows7-x64
1PCICHEK.dll
windows10-2004-x64
1PCICL32.dll
windows7-x64
1PCICL32.dll
windows10-2004-x64
1TCCTL32.dll
windows7-x64
1TCCTL32.dll
windows10-2004-x64
1msvcr100.dll
windows7-x64
3msvcr100.dll
windows10-2004-x64
3pcicapi.dll
windows7-x64
1pcicapi.dll
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2023, 13:03 UTC
Static task
static1
Behavioral task
behavioral1
Sample
HTCTL32.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
HTCTL32.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
PCICHEK.dll
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
PCICHEK.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
PCICL32.dll
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
PCICL32.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
TCCTL32.dll
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
TCCTL32.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
msvcr100.dll
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
msvcr100.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
pcicapi.dll
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
pcicapi.dll
Resource
win10v2004-20230703-en
General
-
Target
HTCTL32.dll
-
Size
320KB
-
MD5
2d3b207c8a48148296156e5725426c7f
-
SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f
-
SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
-
SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
-
SSDEEP
6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2300 616 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3664 wrote to memory of 616 3664 rundll32.exe 84 PID 3664 wrote to memory of 616 3664 rundll32.exe 84 PID 3664 wrote to memory of 616 3664 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\HTCTL32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\HTCTL32.dll,#12⤵PID:616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 6403⤵
- Program crash
PID:2300
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 616 -ip 6161⤵PID:2520
Network
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request108.211.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request54.120.234.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request234.109.124.104.in-addr.arpaIN PTRResponse234.109.124.104.in-addr.arpaIN PTRa104-124-109-234deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request158.240.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request126.160.241.8.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request94.143.109.104.in-addr.arpaIN PTRResponse94.143.109.104.in-addr.arpaIN PTRa104-109-143-94deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request86.8.109.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request169.117.168.52.in-addr.arpaIN PTRResponse
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
74 B 145 B 1 1
DNS Request
108.211.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
76.32.126.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.154.82.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
208.194.73.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
54.120.234.20.in-addr.arpa
-
74 B 141 B 1 1
DNS Request
234.109.124.104.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
158.240.127.40.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
72 B 126 B 1 1
DNS Request
126.160.241.8.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
57.169.31.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
94.143.109.104.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.8.109.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
169.117.168.52.in-addr.arpa