Overview
overview
10Static
static
3ICQLiteShell.dll
windows7-x64
1ICQLiteShell.dll
windows10-2004-x64
1ICQRT.dll
windows7-x64
3ICQRT.dll
windows10-2004-x64
3Language/WinRar.exe
windows7-x64
1Language/WinRar.exe
windows10-2004-x64
1LiteRes.dll
windows7-x64
1LiteRes.dll
windows10-2004-x64
1LiteSkinUtils.dll
windows7-x64
1LiteSkinUtils.dll
windows10-2004-x64
3bentonite.png
windows7-x64
3bentonite.png
windows10-2004-x64
3setup.exe
windows7-x64
10setup.exe
windows10-2004-x64
9Analysis
-
max time kernel
127s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-02-2024 08:58
Static task
static1
Behavioral task
behavioral1
Sample
ICQLiteShell.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ICQLiteShell.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
ICQRT.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
ICQRT.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
Language/WinRar.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Language/WinRar.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
LiteRes.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
LiteRes.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
LiteSkinUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
LiteSkinUtils.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
bentonite.png
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
bentonite.png
Resource
win10v2004-20240221-en
General
-
Target
ICQRT.dll
-
Size
32KB
-
MD5
1aedcb8994d6ad63ef9dcb87016e028f
-
SHA1
f5b891aa15c6353b681bdb7e2d96c6ac8a5f02d7
-
SHA256
53e1f40144bab532f9700ff25ec3d5c6a39784a98e17fada583b4ee6d9dd5dbc
-
SHA512
89c0f408797c4d78afc52335a9e162345c614e1e419f55487cb358c14f7a69ec82138a7e6250be3133233386ba3659d241e80ab63c9b972b6c8b26b0424cb0c8
-
SSDEEP
384:+qtTeds1tkMAp4TxCW9su5UcSu93ggoXUQQIPGEANHl:FTedukelF95RjQUUPpANHl
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1676 2344 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1612 wrote to memory of 2344 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 2344 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 2344 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 2344 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 2344 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 2344 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 2344 1612 rundll32.exe rundll32.exe PID 2344 wrote to memory of 1676 2344 rundll32.exe WerFault.exe PID 2344 wrote to memory of 1676 2344 rundll32.exe WerFault.exe PID 2344 wrote to memory of 1676 2344 rundll32.exe WerFault.exe PID 2344 wrote to memory of 1676 2344 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ICQRT.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ICQRT.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 2283⤵
- Program crash
PID:1676