Overview

overview

7

Static

static

3

PrismLaunc....1.exe

windows7-x64

7

PrismLaunc....1.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Qt6Core.dll

windows7-x64

1

Qt6Core.dll

windows10-2004-x64

1

Qt6Core5Compat.dll

windows7-x64

1

Qt6Core5Compat.dll

windows10-2004-x64

1

Qt6Gui.dll

windows7-x64

1

Qt6Gui.dll

windows10-2004-x64

1

Qt6Network.dll

windows7-x64

1

Qt6Network.dll

windows10-2004-x64

1

Qt6Svg.dll

windows7-x64

1

Qt6Svg.dll

windows10-2004-x64

1

Qt6Widgets.dll

windows7-x64

1

Qt6Widgets.dll

windows10-2004-x64

1

Qt6Xml.dll

windows7-x64

1

Qt6Xml.dll

windows10-2004-x64

1

iconengine...on.dll

windows7-x64

1

iconengine...on.dll

windows10-2004-x64

1

imageformats/qgif.dll

windows7-x64

1

imageformats/qgif.dll

windows10-2004-x64

1

imageforma...ns.dll

windows7-x64

1

imageforma...ns.dll

windows10-2004-x64

1

imageformats/qico.dll

windows7-x64

1

imageformats/qico.dll

windows10-2004-x64

1

imageforma...eg.dll

windows7-x64

1

imageforma...eg.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    134s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 03:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    7KB

  • MD5

    675c4948e1efc929edcabfe67148eddd

  • SHA1

    f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

  • SHA256

    1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

  • SHA512

    61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

  • SSDEEP

    96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2940
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
      2⤵
        PID:3224
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 612
          3⤵
          • Program crash
          PID:4048
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3224 -ip 3224
      1⤵
        PID:2108
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4824

        Network

        • flag-us
          DNS
          104.219.191.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          104.219.191.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          0.204.248.87.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          0.204.248.87.in-addr.arpa
          IN PTR
          Response
          0.204.248.87.in-addr.arpa
          IN PTR
          https-87-248-204-0lhrllnwnet
        • flag-us
          DNS
          23.159.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          23.159.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          133.211.185.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          133.211.185.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          86.23.85.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          86.23.85.13.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          198.187.3.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          198.187.3.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          28.143.109.104.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          28.143.109.104.in-addr.arpa
          IN PTR
          Response
          28.143.109.104.in-addr.arpa
          IN PTR
          a104-109-143-28deploystaticakamaitechnologiescom
        • flag-us
          DNS
          240.197.17.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          240.197.17.2.in-addr.arpa
          IN PTR
          Response
          240.197.17.2.in-addr.arpa
          IN PTR
          a2-17-197-240deploystaticakamaitechnologiescom
        • flag-us
          DNS
          30.243.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          30.243.111.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          249.197.17.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          249.197.17.2.in-addr.arpa
          IN PTR
          Response
          249.197.17.2.in-addr.arpa
          IN PTR
          a2-17-197-249deploystaticakamaitechnologiescom
        • flag-us
          DNS
          2.17.178.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          2.17.178.52.in-addr.arpa
          IN PTR
          Response
        No results found
        • 8.8.8.8:53
          104.219.191.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          104.219.191.52.in-addr.arpa

        • 8.8.8.8:53
          0.204.248.87.in-addr.arpa
          dns
          71 B
           116 B
           1
          1

          DNS Request

          0.204.248.87.in-addr.arpa

        • 8.8.8.8:53
          23.159.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          23.159.190.20.in-addr.arpa

        • 8.8.8.8:53
          133.211.185.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          133.211.185.52.in-addr.arpa

        • 8.8.8.8:53
          86.23.85.13.in-addr.arpa
          dns
          70 B
           144 B
           1
          1

          DNS Request

          86.23.85.13.in-addr.arpa

        • 8.8.8.8:53
          198.187.3.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          198.187.3.20.in-addr.arpa

        • 8.8.8.8:53
          28.143.109.104.in-addr.arpa
          dns
          73 B
           139 B
           1
          1

          DNS Request

          28.143.109.104.in-addr.arpa

        • 8.8.8.8:53
          240.197.17.2.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          240.197.17.2.in-addr.arpa

        • 8.8.8.8:53
          30.243.111.52.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          30.243.111.52.in-addr.arpa

        • 8.8.8.8:53
          249.197.17.2.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          249.197.17.2.in-addr.arpa

        • 8.8.8.8:53
          2.17.178.52.in-addr.arpa
          dns
          70 B
           144 B
           1
          1

          DNS Request

          2.17.178.52.in-addr.arpa

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.