Overview
overview
7Static
static
76e0d9a7d0e...31.exe
windows7-x64
36e0d9a7d0e...31.exe
windows10-2004-x64
3$EXEFILE.exe
windows7-x64
4$EXEFILE.exe
windows10-2004-x64
4$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3wget.exe
windows7-x64
7wget.exe
windows10-2004-x64
7Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23-01-2024 02:08
Behavioral task
behavioral1
Sample
6e0d9a7d0edb98e599b1195f64455731.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6e0d9a7d0edb98e599b1195f64455731.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$EXEFILE.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$EXEFILE.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
wget.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
wget.exe
Resource
win10v2004-20231215-en
General
-
Target
$PLUGINSDIR/Banner.dll
-
Size
4KB
-
MD5
0116a50101c4107a138a588d1e46fca5
-
SHA1
b781dce23e828cf2b97306661c7dad250a6aaf77
-
SHA256
ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b
-
SHA512
55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2180 wrote to memory of 1716 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 1716 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 1716 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 1716 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 1716 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 1716 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 1716 2180 rundll32.exe rundll32.exe