Overview
overview
10Static
static
3file_release_4.rar
windows7-x64
10file_release_4.rar
windows10-2004-x64
7ICQLiteShell.dll
windows7-x64
1ICQLiteShell.dll
windows10-2004-x64
1ICQRT.dll
windows7-x64
3ICQRT.dll
windows10-2004-x64
3Language/WinRar.exe
windows7-x64
1Language/WinRar.exe
windows10-2004-x64
1LiteRes.dll
windows7-x64
1LiteRes.dll
windows10-2004-x64
1LiteSkinUtils.dll
windows7-x64
1LiteSkinUtils.dll
windows10-2004-x64
3setup.exe
windows7-x64
10setup.exe
windows10-2004-x64
10Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-02-2024 17:45
Static task
static1
Behavioral task
behavioral1
Sample
file_release_4.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
file_release_4.rar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
ICQLiteShell.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
ICQLiteShell.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
ICQRT.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
ICQRT.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
Language/WinRar.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Language/WinRar.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
LiteRes.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
LiteRes.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
LiteSkinUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
LiteSkinUtils.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
setup.exe
Resource
win7-20240221-en
General
-
Target
ICQRT.dll
-
Size
32KB
-
MD5
1aedcb8994d6ad63ef9dcb87016e028f
-
SHA1
f5b891aa15c6353b681bdb7e2d96c6ac8a5f02d7
-
SHA256
53e1f40144bab532f9700ff25ec3d5c6a39784a98e17fada583b4ee6d9dd5dbc
-
SHA512
89c0f408797c4d78afc52335a9e162345c614e1e419f55487cb358c14f7a69ec82138a7e6250be3133233386ba3659d241e80ab63c9b972b6c8b26b0424cb0c8
-
SSDEEP
384:+qtTeds1tkMAp4TxCW9su5UcSu93ggoXUQQIPGEANHl:FTedukelF95RjQUUPpANHl
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2504 2956 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3024 wrote to memory of 2956 3024 rundll32.exe rundll32.exe PID 3024 wrote to memory of 2956 3024 rundll32.exe rundll32.exe PID 3024 wrote to memory of 2956 3024 rundll32.exe rundll32.exe PID 3024 wrote to memory of 2956 3024 rundll32.exe rundll32.exe PID 3024 wrote to memory of 2956 3024 rundll32.exe rundll32.exe PID 3024 wrote to memory of 2956 3024 rundll32.exe rundll32.exe PID 3024 wrote to memory of 2956 3024 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2504 2956 rundll32.exe WerFault.exe PID 2956 wrote to memory of 2504 2956 rundll32.exe WerFault.exe PID 2956 wrote to memory of 2504 2956 rundll32.exe WerFault.exe PID 2956 wrote to memory of 2504 2956 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ICQRT.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ICQRT.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 2283⤵
- Program crash
PID:2504