Analysis
-
max time kernel
202s -
max time network
257s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
01-08-2023 03:55
Static task
static1
Behavioral task
behavioral1
Sample
a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de.dll
Resource
win7-20230712-en
windows7-x64
3 signatures
300 seconds
General
-
Target
a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de.dll
-
Size
6.2MB
-
MD5
374d8e8089ecf5f1a161514d1b346432
-
SHA1
cf3b7d0b7a80a64a5e5a02cf0ea1b588ca0ce0d0
-
SHA256
a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de
-
SHA512
085c681ac01da5fd5dbc922e7039b41bf6c0b0dc0446ac7e8e5ba904c187c32b0b7e081206c50cbe88b1af303ac2215c7672af3ec1a46eb73bcd576b003f628c
-
SSDEEP
98304:BtEdRaCU9BlAa/WtuNABPUM6fgGYa3+HQ6JF4VbFofo4eM5YavbJ9nEv:BtEL8WXtB2kUw14bafo4B5YaTJ9nEv
Malware Config
Extracted
Family
systembc
C2
5.42.65.67:4298
localhost.exchange:4298
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 1 2912 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2912 rundll32.exe 2912 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2912-120-0x00007FFA87950000-0x00007FFA87952000-memory.dmpFilesize
8KB
-
memory/2912-121-0x00007FFA6BE50000-0x00007FFA6C8D9000-memory.dmpFilesize
10.5MB
-
memory/2912-123-0x00007FFA87970000-0x00007FFA87972000-memory.dmpFilesize
8KB
-
memory/2912-124-0x00007FFA86390000-0x00007FFA86392000-memory.dmpFilesize
8KB
-
memory/2912-125-0x00007FFA6BE50000-0x00007FFA6C8D9000-memory.dmpFilesize
10.5MB
-
memory/2912-126-0x00007FFA863A0000-0x00007FFA863A2000-memory.dmpFilesize
8KB
-
memory/2912-122-0x00007FFA87960000-0x00007FFA87962000-memory.dmpFilesize
8KB
-
memory/2912-128-0x00007FFA843C0000-0x00007FFA843C2000-memory.dmpFilesize
8KB
-
memory/2912-127-0x00007FFA843B0000-0x00007FFA843B2000-memory.dmpFilesize
8KB