5bbab96d60704854efd8246a7d9371688b9102261544827fc8884126d70bcb3b

Submit
Reports

Overview

overview

Static

static

Config/Plu...64.dll

windows7-x64

Config/Plu...64.dll

windows10-2004-x64

Config/Plu...64.dll

windows7-x64

Config/Plu...64.dll

windows10-2004-x64

Config/Plu...86.dll

windows7-x64

Config/Plu...86.dll

windows10-2004-x64

Config/Plu...es.dll

windows7-x64

Config/Plu...es.dll

windows10-2004-x64

Config/amd...st.dll

windows7-x64

Config/amd...st.dll

windows10-2004-x64

Config/amd...er.dll

windows7-x64

Config/amd...er.dll

windows10-2004-x64

Config/amd...ot.exe

windows7-x64

Config/amd...ot.exe

windows10-2004-x64

Config/amd...pi.dll

windows7-x64

Config/amd...pi.dll

windows10-2004-x64

Config/amd...dk.exe

windows7-x64

Config/amd...dk.exe

windows10-2004-x64

Config/arm...st.dll

windows7-x64

Config/arm...st.dll

windows10-2004-x64

Config/arm...er.dll

windows7-x64

Config/arm...er.dll

windows10-2004-x64

Config/x86...st.dll

windows7-x64

Config/x86...st.dll

windows10-2004-x64

Config/x86...er.dll

windows7-x64

Config/x86...er.dll

windows10-2004-x64

Config/x86...ot.exe

windows7-x64

Config/x86...ot.exe

windows10-2004-x64

Config/x86...pi.dll

windows7-x64

Config/x86...pi.dll

windows10-2004-x64

Config/x86/wofadk.exe

windows7-x64

Config/x86/wofadk.exe

windows10-2004-x64

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2023 01:32

Sharing

Copy URL

Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.amd64.dll

Resource

win7-20230831-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.amd64.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.arm64.dll

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.arm64.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.x86.dll

Resource

win7-20230831-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.x86.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/PluginRes.dll

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/PluginRes.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Config/amd64/CBSHost.dll

Resource

win7-20230831-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

Config/amd64/CBSHost.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

Config/amd64/NCleaner.dll

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

Config/amd64/NCleaner.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

Config/amd64/bcdboot.exe

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

Config/amd64/bcdboot.exe

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

Config/amd64/wimgapi.dll

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

Config/amd64/wimgapi.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

Config/amd64/wofadk.exe

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

Config/amd64/wofadk.exe

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

Config/arm64/CBSHost.dll

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

Config/arm64/CBSHost.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

Config/arm64/NCleaner.dll

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

Config/arm64/NCleaner.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

Config/x86/CBSHost.dll

Resource

win7-20230831-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

Config/x86/CBSHost.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

Config/x86/NCleaner.dll

Resource

win7-20230831-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

Config/x86/NCleaner.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

Config/x86/bcdboot.exe

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

Config/x86/bcdboot.exe

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

Config/x86/wimgapi.dll

Resource

win7-20230831-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

Config/x86/wimgapi.dll

Resource

win10v2004-20230831-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

Config/x86/wofadk.exe

Resource

win7-20230831-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

Config/x86/wofadk.exe

Resource

win10v2004-20230831-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

Config/x86/NCleaner.dll
Size

35KB
MD5

8fd2598d9c61ed8dff6d7bf661bf8287
SHA1

c106545a52667ea5e6db8d16ee1744c4dab97587
SHA256

a1f16902ff0594a80da523dff4b8340b231188125dbfb87fe3e2f0ce23276253
SHA512

04859d231bcfda0160272fd6821a3c4442fb539d797d9684ac6714c9a5f96178f20fa1b3d03a8c18e455b47d4b2f13f66f086cb3fcb34d1bec3c4cc96a19bc7e
SSDEEP

768:1Wf30x2ygVdk0c3uCGY2lIug2umQxZ4dx/xLp98fqp:1WPGgVOHBGtg2Y2Eqp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 456	4452	rundll32.exe	83
PID 4452 wrote to memory of 456	4452	rundll32.exe	83
PID 4452 wrote to memory of 456	4452	rundll32.exe	83

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\x86\NCleaner.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\x86\NCleaner.dll,#1
  2⤵
  PID:456

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads