Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 18:28
Behavioral task
behavioral1
Sample
0073de463a0641808c9e6c5a08e4f222.dll
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0073de463a0641808c9e6c5a08e4f222.dll
-
Size
236KB
-
MD5
0073de463a0641808c9e6c5a08e4f222
-
SHA1
99f3956709c6f75f191e02876d311455258af878
-
SHA256
8d0824c5f74fc47720a1598f5e4ada19ccd851e7548e3b7ab66ef8c0a074afc5
-
SHA512
9a1a78ba4408da3c8b5221e80cedb455b762d3cfe62757563242e2c00b01a4709ae2211638e85692c42e8793a27e6396d888f5939e417e5b51858095f210808a
-
SSDEEP
6144:tLOHgsqDQsf+YdotO7HlX0FDnH7SXaRY7Hbohjyu1MjYnjOGyj:t/DYLtOJXYD7y7HUhe6ti
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Processes:
resource yara_rule behavioral2/memory/3812-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/3812-1-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3944 3812 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2704 wrote to memory of 3812 2704 rundll32.exe rundll32.exe PID 2704 wrote to memory of 3812 2704 rundll32.exe rundll32.exe PID 2704 wrote to memory of 3812 2704 rundll32.exe rundll32.exe
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0073de463a0641808c9e6c5a08e4f222.dll,#11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 7522⤵
- Program crash
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0073de463a0641808c9e6c5a08e4f222.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3812 -ip 38121⤵