Overview

overview

10

Static

static

10

Install Termius.exe

windows7-x64

4

Install Termius.exe

windows10-2004-x64

5

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

resources/...ar.dll

windows7-x64

3

resources/...ar.dll

windows10-2004-x64

3

resources/...dex.js

windows7-x64

1

resources/...dex.js

windows10-2004-x64

1

resources/...or.dll

windows7-x64

3

resources/...or.dll

windows10-2004-x64

3

resources/...46.dll

windows7-x64

1

resources/...46.dll

windows10-2004-x64

3

resources/...o2.dll

windows7-x64

3

resources/...o2.dll

windows10-2004-x64

3

resources/...js.dll

windows7-x64

3

resources/...js.dll

windows10-2004-x64

3

resources/...48.dll

windows7-x64

1

resources/...48.dll

windows10-2004-x64

1

resources/...20.dll

windows7-x64

3

resources/...20.dll

windows10-2004-x64

3

resources/...b1.dll

windows7-x64

3

resources/...b1.dll

windows10-2004-x64

3

resources/...dex.js

windows7-x64

1

resources/...dex.js

windows10-2004-x64

1

resources/...h2.dll

windows7-x64

3

resources/...h2.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    146s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-02-2024 14:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/ssl-48.dll

  • Size

    336KB

  • MD5

    69f37486367f3d3b297142fb623b9185

  • SHA1

    768894ff2d59819666ca4c522d28b35cb79d9890

  • SHA256

    587ad436b0e758c9f09cefd1039ebe5bfe726fe314fb0d43a2833ab8251b3ec0

  • SHA512

    079535f02a69e4ee4da9ab40a9c3f6ee798297a6bfaf9f3ee7b70e9bba8a44a4de8209afe8205638a170463a731bd2dc97523e630455c80c31499ecb15748262

  • SSDEEP

    6144:MTinsVQMjqBALNMxWBywI3PQMgDrSeiocjcUbmYObux9ESliKyuKCZJOGuv9o9/B:rnsmMjqSBMxW0wIoMgDN1ylEekQYv3lg

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\ssl-48.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\ssl-48.dll,#1
      2⤵
        PID:888

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads