Analysis
-
max time kernel
290s -
max time network
259s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
09-08-2023 03:45
Behavioral task
behavioral1
Sample
b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793.dll
Resource
win7-20230712-en
windows7-x64
4 signatures
300 seconds
General
-
Target
b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793.dll
-
Size
6.0MB
-
MD5
62813c6cab9234e83949fcc563c33b57
-
SHA1
474c9abc14fea035d0e80128dbd7260f0cbc42b2
-
SHA256
b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793
-
SHA512
a29cdda3218566509cfc3d07b50bfe9ece45fd6a57cb12b649b283204191326e30746bc9d33c63b2e8281b65fd1f19cc79092b81e8cd67d593010c3574986542
-
SSDEEP
98304:Yk/CgBuUFSDyJ6FqBh2Rvtu9+GdULsSuPbm5u1et8yDD27AadUEpnoj:DBumcyJ6O3LdCgPbSket8yDDTsGj
Malware Config
Extracted
Family
systembc
C2
5.42.65.67:4298
localhost.exchange:4298
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 1 4800 rundll32.exe -
Processes:
resource yara_rule behavioral2/memory/4800-122-0x00007FFEA11C0000-0x00007FFEA1C44000-memory.dmp vmprotect behavioral2/memory/4800-130-0x00007FFEA11C0000-0x00007FFEA1C44000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 4800 rundll32.exe 4800 rundll32.exe 4800 rundll32.exe 4800 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4800-121-0x00007FFEBD1F0000-0x00007FFEBD1F2000-memory.dmpFilesize
8KB
-
memory/4800-122-0x00007FFEA11C0000-0x00007FFEA1C44000-memory.dmpFilesize
10.5MB
-
memory/4800-123-0x00007FFEBD200000-0x00007FFEBD202000-memory.dmpFilesize
8KB
-
memory/4800-124-0x00007FFEBCC60000-0x00007FFEBCC62000-memory.dmpFilesize
8KB
-
memory/4800-126-0x00007FFEBA520000-0x00007FFEBA522000-memory.dmpFilesize
8KB
-
memory/4800-125-0x00007FFEBCC70000-0x00007FFEBCC72000-memory.dmpFilesize
8KB
-
memory/4800-127-0x00007FFEBA530000-0x00007FFEBA532000-memory.dmpFilesize
8KB
-
memory/4800-129-0x00007FFEBD210000-0x00007FFEBD212000-memory.dmpFilesize
8KB
-
memory/4800-130-0x00007FFEA11C0000-0x00007FFEA1C44000-memory.dmpFilesize
10.5MB
-
memory/4800-131-0x00000185D7200000-0x00000185D72BF000-memory.dmpFilesize
764KB