Analysis
-
max time kernel
127s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
09-08-2023 08:37
General
-
Target
ede84803bface8bb45d2f293d8766f6099dab30b1f2d74207398835ff255e385.dll
-
Size
5.8MB
-
MD5
e3fe0be8cd50ca837069bc2564ab0532
-
SHA1
05e41077b6ebefe2fc34b03055f8c5b31cff1664
-
SHA256
ede84803bface8bb45d2f293d8766f6099dab30b1f2d74207398835ff255e385
-
SHA512
7fd879b48873530aa3d1933e537f99f53909fc3604da6cc88388e51e560b5aecbe31801f3daf2096c190f7c8e1b878e3566874c2e1f937254cbf8a59654e7497
-
SSDEEP
98304:QrsZ8pbhGL9G900NEOrx0i5P4GzmJPLYJZLKU9Q+Rg8gvUbgQw3/5cU6mWL:QawGMvrui5VWUDLKUe+yN5Qy5cH
Malware Config
Extracted
Family
systembc
C2
5.42.65.67:4298
localhost.exchange:4298
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 1 1632 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1632-119-0x00007FFAD97B0000-0x00007FFADA17A000-memory.dmp vmprotect behavioral1/memory/1632-126-0x00007FFAD97B0000-0x00007FFADA17A000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 1632 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1632-117-0x00007FFAEA1B0000-0x00007FFAEA1B2000-memory.dmpFilesize
8KB
-
memory/1632-119-0x00007FFAD97B0000-0x00007FFADA17A000-memory.dmpFilesize
9.8MB
-
memory/1632-118-0x00007FFAEA1C0000-0x00007FFAEA1C2000-memory.dmpFilesize
8KB
-
memory/1632-120-0x00007FFAE9920000-0x00007FFAE9922000-memory.dmpFilesize
8KB
-
memory/1632-121-0x00007FFAE9930000-0x00007FFAE9932000-memory.dmpFilesize
8KB
-
memory/1632-122-0x00007FFAE6C20000-0x00007FFAE6C22000-memory.dmpFilesize
8KB
-
memory/1632-123-0x00007FFAE6C30000-0x00007FFAE6C32000-memory.dmpFilesize
8KB
-
memory/1632-125-0x00007FFAEA1D0000-0x00007FFAEA1D2000-memory.dmpFilesize
8KB
-
memory/1632-126-0x00007FFAD97B0000-0x00007FFADA17A000-memory.dmpFilesize
9.8MB