Overview
overview
7Static
static
704e6290276...f9.exe
windows7-x64
704e6290276...f9.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDIR/pwgen.dll
windows7-x64
3$PLUGINSDIR/pwgen.dll
windows10-2004-x64
3Launcher.exe
windows7-x64
1Launcher.exe
windows10-2004-x64
1wget.exe
windows7-x64
7wget.exe
windows10-2004-x64
7Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10-03-2024 18:12
Behavioral task
behavioral1
Sample
04e629027649a7dcf4595df3f4df38427d08d1ce2277b660e662d038b9f92df9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04e629027649a7dcf4595df3f4df38427d08d1ce2277b660e662d038b9f92df9.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/pwgen.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/pwgen.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Launcher.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Launcher.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
wget.exe
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
wget.exe
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/Banner.dll
-
Size
4KB
-
MD5
0116a50101c4107a138a588d1e46fca5
-
SHA1
b781dce23e828cf2b97306661c7dad250a6aaf77
-
SHA256
ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b
-
SHA512
55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1972 wrote to memory of 1800 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1800 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1800 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1800 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1800 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1800 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1800 1972 rundll32.exe rundll32.exe