Overview
overview
10Static
static
3dcdc99a71a...3b.exe
windows7-x64
10dcdc99a71a...3b.exe
windows10-2004-x64
10$TEMP/Part...ri.dll
windows7-x64
10$TEMP/Part...ri.dll
windows10-2004-x64
10$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...ps.dll
windows7-x64
1$TEMP/what...ps.dll
windows10-2004-x64
1$TEMP/what...ui.dll
windows7-x64
1$TEMP/what...ui.dll
windows10-2004-x64
1$TEMP/what...er.dll
windows7-x64
1$TEMP/what...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
170s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 07:58
Static task
static1
Behavioral task
behavioral1
Sample
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$TEMP/PartiShikari.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$TEMP/PartiShikari.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/whatnot/failure/cgi-bin/33.opends60.dll
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
$TEMP/whatnot/failure/cgi-bin/33.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/whatnot/failure/cgi-bin/69.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/whatnot/failure/cgi-bin/69.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$TEMP/whatnot/failure/cgi-bin/79.opends60.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$TEMP/whatnot/failure/cgi-bin/79.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$TEMP/whatnot/failure/cgi-bin/edbgps.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$TEMP/whatnot/failure/cgi-bin/edbgps.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$TEMP/whatnot/failure/cgi-bin/hxvzui.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$TEMP/whatnot/failure/cgi-bin/hxvzui.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll
Resource
win10v2004-20240226-en
General
-
Target
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll
-
Size
5KB
-
MD5
ea10730088607402b9847df60ddf682b
-
SHA1
28b4b4232bfa6ca50a219c812662b814c92a934e
-
SHA256
f4f244516ff66af8827603af7adc897410760904067bccd793ce311c01e69daa
-
SHA512
ed723d3adf51e5fb89ee32c1b082f1bfe4c87b3e43c9c326054ab6c9133e16c130886ef9bd0990dc376fb620b67c3f070843114f4f75c3d5824a050b47403812
-
SSDEEP
48:C0ytDZk8cf6uE4PYPF18s42oTNZuvUtZWNHWHlDnIBSrSFg5WWrn56:7ytDZfcSu7gPF42ONY6Wt0JnIBdF0WP
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4700 wrote to memory of 368 4700 rundll32.exe rundll32.exe PID 4700 wrote to memory of 368 4700 rundll32.exe rundll32.exe PID 4700 wrote to memory of 368 4700 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\whatnot\failure\cgi-bin\sbsdiasymreader.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\whatnot\failure\cgi-bin\sbsdiasymreader.dll,#12⤵