Overview
overview
7Static
static
7DllEmForm.dll
windows7-x64
6DllEmForm.dll
windows10-2004-x64
6TYFrame.exe
windows7-x64
7TYFrame.exe
windows10-2004-x64
7data/bmnet.sys
windows7-x64
1data/bmnet.sys
windows10-2004-x64
1data/drvinst.exe
windows7-x64
1data/drvinst.exe
windows10-2004-x64
1data/新云软件.url
windows7-x64
1data/新云软件.url
windows10-2004-x64
1libeay32.dll
windows7-x64
1libeay32.dll
windows10-2004-x64
1prcdcdll.dll
windows7-x64
6prcdcdll.dll
windows10-2004-x64
6ssleay32.dll
windows7-x64
1ssleay32.dll
windows10-2004-x64
1tyframe.exe
windows7-x64
1tyframe.exe
windows10-2004-x64
1unicallem.dll
windows7-x64
6unicallem.dll
windows10-2004-x64
6unins000.exe
windows7-x64
7unins000.exe
windows10-2004-x64
7update.exe
windows7-x64
1update.exe
windows10-2004-x64
1Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2024 03:24
Behavioral task
behavioral1
Sample
DllEmForm.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DllEmForm.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
TYFrame.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
TYFrame.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
data/bmnet.sys
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
data/bmnet.sys
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
data/drvinst.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
data/drvinst.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
data/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
data/新云软件.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
libeay32.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
libeay32.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
prcdcdll.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
prcdcdll.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
ssleay32.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
ssleay32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
tyframe.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
tyframe.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral19
Sample
unicallem.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
unicallem.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
unins000.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
unins000.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
update.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
update.exe
Resource
win10v2004-20240226-en
General
-
Target
ssleay32.dll
-
Size
196KB
-
MD5
ba575f68b5c3d4f0ca752d92dfdc109a
-
SHA1
054f07ba687912602b03daf4d0e5cc6e8cf4d74e
-
SHA256
34fd5e3d0a0986cffe206b7271b0d1743bacfb1666f9fdfe91bc627045072bef
-
SHA512
c795904f3e8c3f5f605533339a7fe83e8ee9444adc2782b607da929888eeccdfa994cf482aa61042ed74016031c9c0fbec9f1e1e144f663e07bcd39b5f9879d6
-
SSDEEP
3072:iP+SbFNHCl/OBsB5mq7a0AVZttATGxiE92sgY116E7uAsa3x+OEW:iPrFNHs/OqYqvlTGxiEvgY116m3W
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3264 wrote to memory of 2632 3264 rundll32.exe 84 PID 3264 wrote to memory of 2632 3264 rundll32.exe 84 PID 3264 wrote to memory of 2632 3264 rundll32.exe 84