Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 07:21
Behavioral task
behavioral1
Sample
79cdf5c7a5131d8ac7dddfd867a1c454b6d6277463a510a6440666cdeb25f386.dll
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
79cdf5c7a5131d8ac7dddfd867a1c454b6d6277463a510a6440666cdeb25f386.dll
Resource
win10v2004-20230915-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
79cdf5c7a5131d8ac7dddfd867a1c454b6d6277463a510a6440666cdeb25f386.dll
-
Size
5.3MB
-
MD5
f3ff45d2e8bff67d85031472bc49aa43
-
SHA1
e08c06665e677a8ac90aa2f652559ec1343d5c78
-
SHA256
79cdf5c7a5131d8ac7dddfd867a1c454b6d6277463a510a6440666cdeb25f386
-
SHA512
070ce53d6c61e01e5f4e1f5e6acd4a8ea4a09c81be0ea86665b6416c590eea787feb3fb837188c9faee042ff00cf322d789255b34286fe595dc9ec06f03f10c2
-
SSDEEP
98304:kwalFfCaIRiYkx/yaR29rF9yV8Ynzueh3PSZ6DN225nLgmr/P72ud/+K:lqfrIRi/x/PRegzFSZcRQx
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 5 2184 rundll32.exe 8 2184 rundll32.exe 13 2184 rundll32.exe 14 2184 rundll32.exe 15 2184 rundll32.exe 17 2184 rundll32.exe 18 2184 rundll32.exe 20 2184 rundll32.exe 21 2184 rundll32.exe 22 2184 rundll32.exe 23 2184 rundll32.exe 25 2184 rundll32.exe 26 2184 rundll32.exe 27 2184 rundll32.exe 28 2184 rundll32.exe 29 2184 rundll32.exe 30 2184 rundll32.exe 31 2184 rundll32.exe 32 2184 rundll32.exe 33 2184 rundll32.exe 34 2184 rundll32.exe 35 2184 rundll32.exe 36 2184 rundll32.exe 37 2184 rundll32.exe 38 2184 rundll32.exe 39 2184 rundll32.exe 40 2184 rundll32.exe 42 2184 rundll32.exe 43 2184 rundll32.exe 44 2184 rundll32.exe 45 2184 rundll32.exe 46 2184 rundll32.exe 47 2184 rundll32.exe 48 2184 rundll32.exe 50 2184 rundll32.exe 51 2184 rundll32.exe 53 2184 rundll32.exe 54 2184 rundll32.exe 55 2184 rundll32.exe 57 2184 rundll32.exe 58 2184 rundll32.exe 59 2184 rundll32.exe 60 2184 rundll32.exe 61 2184 rundll32.exe 62 2184 rundll32.exe 63 2184 rundll32.exe 64 2184 rundll32.exe 65 2184 rundll32.exe 66 2184 rundll32.exe 67 2184 rundll32.exe 68 2184 rundll32.exe 69 2184 rundll32.exe 70 2184 rundll32.exe 71 2184 rundll32.exe 72 2184 rundll32.exe 73 2184 rundll32.exe 74 2184 rundll32.exe 75 2184 rundll32.exe 76 2184 rundll32.exe 77 2184 rundll32.exe 78 2184 rundll32.exe 79 2184 rundll32.exe 80 2184 rundll32.exe 81 2184 rundll32.exe -
resource yara_rule behavioral1/memory/2184-0-0x00000000738F0000-0x0000000074173000-memory.dmp vmprotect behavioral1/memory/2184-13-0x00000000738F0000-0x0000000074173000-memory.dmp vmprotect behavioral1/memory/2184-3-0x00000000738F0000-0x0000000074173000-memory.dmp vmprotect behavioral1/memory/2184-14-0x00000000738F0000-0x0000000074173000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2184 rundll32.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 251 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2184 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2184 2116 rundll32.exe 18 PID 2116 wrote to memory of 2184 2116 rundll32.exe 18 PID 2116 wrote to memory of 2184 2116 rundll32.exe 18 PID 2116 wrote to memory of 2184 2116 rundll32.exe 18 PID 2116 wrote to memory of 2184 2116 rundll32.exe 18 PID 2116 wrote to memory of 2184 2116 rundll32.exe 18 PID 2116 wrote to memory of 2184 2116 rundll32.exe 18
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79cdf5c7a5131d8ac7dddfd867a1c454b6d6277463a510a6440666cdeb25f386.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79cdf5c7a5131d8ac7dddfd867a1c454b6d6277463a510a6440666cdeb25f386.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2184
-