Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04/02/2024, 16:12

General

  • Target

    VirusShare_849c748f9a37d4125779f6b31435d220.dll

  • Size

    156KB

  • MD5

    849c748f9a37d4125779f6b31435d220

  • SHA1

    ab26f79f3726b2a066f73f2711d8362486ff93ce

  • SHA256

    a7d1e0426d5ec9205c571cbafa558475f0a8fb701500a1353fd8fd5ad5a91c89

  • SHA512

    131d7c664211b581d061005ad6686e4dd2191727ced66b371dbc34895f2f426bc57d93c97da2ed39bd47b00154c96827d7d4868001a62e7f1027d0aea621468c

  • SSDEEP

    3072:NLkD7BY9kS2O0to3IzwtVgHtWt8PgIJY7Ctp:NLS7BCk1tWIiV0Wq3JY7C

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 13 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_849c748f9a37d4125779f6b31435d220.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_849c748f9a37d4125779f6b31435d220.dll,#1
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\PROGRA~3\ggdvtnb.cpp,XXS1
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Drops file in Program Files directory
        PID:1664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\bntvdgg.fee

    Filesize

    1.9MB

    MD5

    901f48ef078bc4b200b5e50ecae97049

    SHA1

    b807014d28479c1c6bd25b3cae2906587e97bcd9

    SHA256

    66b6854ce91c301150da8a1347705d640d37ccb56ee5ac1a5d86c61683658eef

    SHA512

    4fb76f0a505953bdda29e6c4e00a874f6239b86141a2a6daa467bdf1cfd1274af600a2027babc540b212540ec27a6f8c0616b7e1dc0b864ef0d24901b3fce06e

  • C:\PROGRA~3\ggdvtnb.cpp

    Filesize

    156KB

    MD5

    849c748f9a37d4125779f6b31435d220

    SHA1

    ab26f79f3726b2a066f73f2711d8362486ff93ce

    SHA256

    a7d1e0426d5ec9205c571cbafa558475f0a8fb701500a1353fd8fd5ad5a91c89

    SHA512

    131d7c664211b581d061005ad6686e4dd2191727ced66b371dbc34895f2f426bc57d93c97da2ed39bd47b00154c96827d7d4868001a62e7f1027d0aea621468c

  • memory/1104-27-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1104-0-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1104-3-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1104-4-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1104-2-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-39-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1664-28-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1664-10-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1664-56-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1664-151-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1664-183-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1664-194-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1664-211-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB

  • memory/1664-247-0x000000000B000000-0x000000000B031000-memory.dmp

    Filesize

    196KB