Analysis
-
max time kernel
142s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2023 16:30
Static task
static1
Behavioral task
behavioral1
Sample
374d8e8089ecf5f1a161514d1b346432.dll
Resource
win7-20230712-en
3 signatures
150 seconds
General
-
Target
374d8e8089ecf5f1a161514d1b346432.dll
-
Size
6.2MB
-
MD5
374d8e8089ecf5f1a161514d1b346432
-
SHA1
cf3b7d0b7a80a64a5e5a02cf0ea1b588ca0ce0d0
-
SHA256
a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de
-
SHA512
085c681ac01da5fd5dbc922e7039b41bf6c0b0dc0446ac7e8e5ba904c187c32b0b7e081206c50cbe88b1af303ac2215c7672af3ec1a46eb73bcd576b003f628c
-
SSDEEP
98304:BtEdRaCU9BlAa/WtuNABPUM6fgGYa3+HQ6JF4VbFofo4eM5YavbJ9nEv:BtEL8WXtB2kUw14bafo4B5YaTJ9nEv
Malware Config
Extracted
Family
systembc
C2
5.42.65.67:4298
localhost.exchange:4298
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 35 4804 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4804 rundll32.exe 4804 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4804-135-0x00007FF91A550000-0x00007FF91AFD9000-memory.dmpFilesize
10.5MB
-
memory/4804-136-0x00007FF9380F0000-0x00007FF9380F2000-memory.dmpFilesize
8KB
-
memory/4804-134-0x00007FF9380E0000-0x00007FF9380E2000-memory.dmpFilesize
8KB
-
memory/4804-133-0x00007FF9380D0000-0x00007FF9380D2000-memory.dmpFilesize
8KB
-
memory/4804-137-0x00007FF937800000-0x00007FF937802000-memory.dmpFilesize
8KB
-
memory/4804-139-0x00007FF91A550000-0x00007FF91AFD9000-memory.dmpFilesize
10.5MB
-
memory/4804-140-0x00007FF935C90000-0x00007FF935C92000-memory.dmpFilesize
8KB
-
memory/4804-138-0x00007FF937810000-0x00007FF937812000-memory.dmpFilesize
8KB
-
memory/4804-141-0x00007FF935CA0000-0x00007FF935CA2000-memory.dmpFilesize
8KB