Analysis
-
max time kernel
124s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
23/09/2023, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
UpdateCheck.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
UpdateCheck.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
libcurl.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
libcurl.dll
Resource
win10v2004-20230915-en
General
-
Target
libcurl.dll
-
Size
92KB
-
MD5
680f1dfc326680600c8111659b4b4e26
-
SHA1
1babb010c78762ca8eeb1b8d41a0902dc485659c
-
SHA256
ceaec139a9370a4cd4eca876e7c4b3d51a013d3739b3f4d526fdfeab27cd2fc2
-
SHA512
9aa8e7fc98b14457cb58f647d274de60fa4c4956f8369d150b09f3dcd871262dd210e840a9481178399b21d64115a64dc89e736dcc7b0bc817bbc59acfd095b5
-
SSDEEP
1536:32vMx2qCrMiZ+A8/OtS3Fa6MCQmd6C71SJCpQsWBhyd09dlZYBwV0pC:8MIqCrM7Ak6aFaGQU6C8Mp06MvmS0I
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 3 1764 rundll32.exe 6 1764 rundll32.exe 7 1764 rundll32.exe 8 1764 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1764 rundll32.exe