Overview
overview
10Static
static
3Set@up#!Fi...up.exe
windows7-x64
5Set@up#!Fi...up.exe
windows10-2004-x64
10Set@up#!Fi...-6.dll
windows7-x64
1Set@up#!Fi...-6.dll
windows10-2004-x64
3Set@up#!Fi...-6.dll
windows7-x64
1Set@up#!Fi...-6.dll
windows10-2004-x64
3Set@up#!Fi...-6.dll
windows7-x64
1Set@up#!Fi...-6.dll
windows10-2004-x64
3Set@up#!Fi...dl.dll
windows7-x64
1Set@up#!Fi...dl.dll
windows10-2004-x64
3Set@up#!Fi...-1.dll
windows7-x64
1Set@up#!Fi...-1.dll
windows10-2004-x64
3Set@up#!Fi...-1.dll
windows7-x64
1Set@up#!Fi...-1.dll
windows10-2004-x64
3Set@up#!Fi...-1.dll
windows7-x64
1Set@up#!Fi...-1.dll
windows10-2004-x64
3Set@up#!Fi...-0.dll
windows7-x64
1Set@up#!Fi...-0.dll
windows10-2004-x64
3Set@up#!Fi...-0.dll
windows7-x64
1Set@up#!Fi...-0.dll
windows10-2004-x64
3Set@up#!Fi...-1.dll
windows7-x64
1Set@up#!Fi...-1.dll
windows10-2004-x64
4Set@up#!Fi...b1.dll
windows7-x64
1Set@up#!Fi...b1.dll
windows10-2004-x64
3Analysis
- max time kernel
122s - max time network
129s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
24/02/2024, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
Set@up#!Files-P@ssw0rD__~2402~_/Set-up.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
Set@up#!Files-P@ssw0rD__~2402~_/Set-up.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libX11-6.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libX11-6.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libXau-6.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libXau-6.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libXdmcp-6.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libXdmcp-6.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libdl.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libdl.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libgcc_s_dw2-1.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libgcc_s_dw2-1.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libwinpthread-1.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libwinpthread-1.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libxcb-1.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libxcb-1.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libxcb-image-0.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libxcb-image-0.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libxcb-shm-0.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libxcb-shm-0.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libxcb-util-1.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
Set@up#!Files-P@ssw0rD__~2402~_/libxcb-util-1.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Set@up#!Files-P@ssw0rD__~2402~_/zlib1.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral24
Sample
Set@up#!Files-P@ssw0rD__~2402~_/zlib1.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
General
- Target Set@up#!Files-P@ssw0rD__~2402~_/libX11-6.dll
- Size 1.2MB
- Sample240224-bz3tkadh65
- SHA256 497471497886f18ca16f7facab7d76dc9bfadd69deb9c6e4ea9bdc0869a15628
- MD5 3cd9af46753f2a618d15157372d0d2bc
- SHA1 f2a1781b1a6d33338db4d9725b28f15d8a410903
- SHA512 925097106554f6eac698ba933e32fb82c1405c7ccfe284b27f1558e9ab46139506b1e981721aeafaf2e0d595dbdfce3587c4056c6920fdffb0b2f2bdbdcdb38d
- SSDEEP 24576:uA7S97BMxq0REUm75horlhVwwf7JtdVrd:ud9VMxq0REUm7IrlhVd7d
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2588 3044 rundll32.exe 28 PID 3044 wrote to memory of 2588 3044 rundll32.exe 28 PID 3044 wrote to memory of 2588 3044 rundll32.exe 28 PID 3044 wrote to memory of 2588 3044 rundll32.exe 28 PID 3044 wrote to memory of 2588 3044 rundll32.exe 28 PID 3044 wrote to memory of 2588 3044 rundll32.exe 28 PID 3044 wrote to memory of 2588 3044 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\libX11-6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\libX11-6.dll,#12⤵PID:2588
-