Analysis
- max time kernel
116s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
08/01/2024, 03:51
General
- Target 百度营销王9.0/bdyxw.dll
- Size 612KB
- Sample240108-eespmsbfd3
- SHA256 287d9d1eda063f5ae88b4406f8e9d4253765973db8bf0492bdefca06ac348268
Malware Config
Signatures
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\百度营销王9.0\bdyxw.dll,#11⤵
- Identifies Wine through registry keys
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\百度营销王9.0\bdyxw.dll,#11⤵
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1820-0-0x0000000010000000-0x000000001015A000-memory.dmp
memory/1820-18-0x00000000007B0000-0x00000000007C4000-memory.dmp
memory/1820-17-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/1820-16-0x0000000002480000-0x0000000002481000-memory.dmp
memory/1820-15-0x0000000002490000-0x0000000002491000-memory.dmp
memory/1820-14-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/1820-13-0x00000000007E0000-0x00000000007E1000-memory.dmp
memory/1820-12-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/1820-11-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/1820-10-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/1820-9-0x0000000002400000-0x0000000002401000-memory.dmp
memory/1820-8-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/1820-7-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
memory/1820-6-0x0000000000B00000-0x0000000000B02000-memory.dmp
memory/1820-5-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/1820-4-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/1820-3-0x0000000002410000-0x0000000002411000-memory.dmp
memory/1820-2-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/1820-1-0x0000000002420000-0x0000000002421000-memory.dmp