Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2023 16:16
Static task
static1
General
-
Target
a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de.dll
-
Size
6.2MB
-
MD5
374d8e8089ecf5f1a161514d1b346432
-
SHA1
cf3b7d0b7a80a64a5e5a02cf0ea1b588ca0ce0d0
-
SHA256
a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de
-
SHA512
085c681ac01da5fd5dbc922e7039b41bf6c0b0dc0446ac7e8e5ba904c187c32b0b7e081206c50cbe88b1af303ac2215c7672af3ec1a46eb73bcd576b003f628c
-
SSDEEP
98304:BtEdRaCU9BlAa/WtuNABPUM6fgGYa3+HQ6JF4VbFofo4eM5YavbJ9nEv:BtEL8WXtB2kUw14bafo4B5YaTJ9nEv
Malware Config
Extracted
Family
systembc
C2
5.42.65.67:4298
localhost.exchange:4298
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 28 4288 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4288 rundll32.exe 4288 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4288-134-0x00007FFEF1AA0000-0x00007FFEF1AA2000-memory.dmpFilesize
8KB
-
memory/4288-136-0x00007FFEF1AB0000-0x00007FFEF1AB2000-memory.dmpFilesize
8KB
-
memory/4288-137-0x00007FFEF0F00000-0x00007FFEF0F02000-memory.dmpFilesize
8KB
-
memory/4288-135-0x00007FFED3520000-0x00007FFED3FA9000-memory.dmpFilesize
10.5MB
-
memory/4288-133-0x00007FFEF1A90000-0x00007FFEF1A92000-memory.dmpFilesize
8KB
-
memory/4288-139-0x00007FFEF0F10000-0x00007FFEF0F12000-memory.dmpFilesize
8KB
-
memory/4288-138-0x00007FFED3520000-0x00007FFED3FA9000-memory.dmpFilesize
10.5MB
-
memory/4288-140-0x00007FFEEF280000-0x00007FFEEF282000-memory.dmpFilesize
8KB
-
memory/4288-141-0x00007FFEEF290000-0x00007FFEEF292000-memory.dmpFilesize
8KB