Analysis
-
max time kernel
127s -
max time network
258s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
26-07-2023 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355.dll
Resource
win7-20230712-en
3 signatures
300 seconds
General
-
Target
313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355.dll
-
Size
6.4MB
-
MD5
cb44d16ebac295a75245dce05a75997b
-
SHA1
101cc9e8df36e1e7061f449a84109d1d75e6f8ae
-
SHA256
313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355
-
SHA512
a21a09fe60dd4380fdb9fbbeee0e6f0c543a8182aa6b3be5e77306928222c90bdd27b6dc2a1f54f31a5ba3c0322914a36c009773f30f9b94c4246110254bbb4b
-
SSDEEP
196608:r/Ux5R45q2JoGqtQLHTE/+667kFiQwI99:Ai5q2yXtaU+6U7I
Malware Config
Extracted
Family
systembc
C2
5.42.65.67:4298
localhost.exchange:4298
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 1 1100 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1100 rundll32.exe 1100 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-119-0x00007FF943D60000-0x00007FF9447E4000-memory.dmpFilesize
10.5MB
-
memory/1100-118-0x00007FF95FD50000-0x00007FF95FD52000-memory.dmpFilesize
8KB
-
memory/1100-121-0x00007FF95FD70000-0x00007FF95FD72000-memory.dmpFilesize
8KB
-
memory/1100-120-0x00007FF95FD60000-0x00007FF95FD62000-memory.dmpFilesize
8KB
-
memory/1100-122-0x00007FF95ECE0000-0x00007FF95ECE2000-memory.dmpFilesize
8KB
-
memory/1100-124-0x00007FF95C460000-0x00007FF95C462000-memory.dmpFilesize
8KB
-
memory/1100-123-0x00007FF95ECF0000-0x00007FF95ECF2000-memory.dmpFilesize
8KB
-
memory/1100-125-0x00007FF95C470000-0x00007FF95C472000-memory.dmpFilesize
8KB
-
memory/1100-126-0x00007FF943D60000-0x00007FF9447E4000-memory.dmpFilesize
10.5MB