Overview
overview
10Static
static
3file_release_4.rar
windows7-x64
10file_release_4.rar
windows10-2004-x64
7ICQLiteShell.dll
windows7-x64
1ICQLiteShell.dll
windows10-2004-x64
1ICQRT.dll
windows7-x64
3ICQRT.dll
windows10-2004-x64
3Language/WinRar.exe
windows7-x64
1Language/WinRar.exe
windows10-2004-x64
1LiteRes.dll
windows7-x64
1LiteRes.dll
windows10-2004-x64
1LiteSkinUtils.dll
windows7-x64
1LiteSkinUtils.dll
windows10-2004-x64
3setup.exe
windows7-x64
10setup.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2024 17:45
Static task
static1
Behavioral task
behavioral1
Sample
file_release_4.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
file_release_4.rar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
ICQLiteShell.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
ICQLiteShell.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
ICQRT.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
ICQRT.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
Language/WinRar.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Language/WinRar.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
LiteRes.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
LiteRes.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
LiteSkinUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
LiteSkinUtils.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
setup.exe
Resource
win7-20240221-en
General
-
Target
ICQRT.dll
-
Size
32KB
-
MD5
1aedcb8994d6ad63ef9dcb87016e028f
-
SHA1
f5b891aa15c6353b681bdb7e2d96c6ac8a5f02d7
-
SHA256
53e1f40144bab532f9700ff25ec3d5c6a39784a98e17fada583b4ee6d9dd5dbc
-
SHA512
89c0f408797c4d78afc52335a9e162345c614e1e419f55487cb358c14f7a69ec82138a7e6250be3133233386ba3659d241e80ab63c9b972b6c8b26b0424cb0c8
-
SSDEEP
384:+qtTeds1tkMAp4TxCW9su5UcSu93ggoXUQQIPGEANHl:FTedukelF95RjQUUPpANHl
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1516 2352 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 212 wrote to memory of 2352 212 rundll32.exe rundll32.exe PID 212 wrote to memory of 2352 212 rundll32.exe rundll32.exe PID 212 wrote to memory of 2352 212 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ICQRT.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ICQRT.dll,#12⤵PID:2352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 6003⤵
- Program crash
PID:1516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2352 -ip 23521⤵PID:764