e75b2e3023d9df8e2b4862f040b280dfd18997a11b9b0fc4cb28bc7dafafaa83 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 03:31

Sharing

Report Analysis Logs

General

Target

gensmnq/gensmnq_ttrar/kailleraclient.dll
Size

31KB
MD5

c3f8a9c4cfd257f22ba3a0f2d9e23ff0
SHA1

ad9be4eb84f31b23a6f1ba7cc490940bdde29d64
SHA256

35a8f5f6b858e6af5dc34eec2bbe397ea230c09eaffbb976c42f4b096cfc2551
SHA512

31f77be2487ac691f09bd5e3463c2ed6b00f1f75b3ac6b38becb9377dacb00b3c1aae2de70961212af04e6b0e6f26ab716dead2fb7d87b9c7639ed0e2d27dd99
SSDEEP

768:2viLjbKGY60H17PJc/TG0BXOZDRm55lEv1Lk1:oK/Oh17PeqAgDRmjym1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2040-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx
behavioral3/memory/2040-1-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gensmnq\gensmnq_ttrar\kailleraclient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gensmnq\gensmnq_ttrar\kailleraclient.dll,#1
  2⤵
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2040-1-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download