Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 16:55
Behavioral task
behavioral1
Sample
SpecialForce.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
SpecialForce.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
xtrap/XTrap.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
xtrap/XTrap.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
xtrap/XTrapVa.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
xtrap/XTrapVa.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
xtrap/psapi.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
xtrap/psapi.dll
Resource
win10v2004-20240412-en
General
-
Target
xtrap/XTrapVa.dll
-
Size
366KB
-
MD5
b8905d3871d3efa6831d3f08ab4c3fd0
-
SHA1
ba8af062cfb715d5ba2ce1a62639893698ad75c5
-
SHA256
d020bcf60c37f0921dcb9321b40e44ad02f5fc86994f77168d54879d6d369475
-
SHA512
c7ab8d726588dfeaca3488aa37c1097bdc3e28a0d5ceed16852df4486d503e92839881c6ae77c04d599653f85305fd0591b4bf4aa52355b9969704f91066a56a
-
SSDEEP
6144:/r/0EwgUPndxYwad+9lNKKZqN1cNwPLvoqg0R2VhPefm0TouD4fjIlK+Qp0rSk:TnBekwad+lvUN1c2obY7nVQCrb
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1932 wrote to memory of 2492 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2492 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2492 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2492 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2492 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2492 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2492 1932 rundll32.exe rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2492-0-0x0000000040400000-0x0000000040485000-memory.dmpFilesize
532KB
-
memory/2492-2-0x0000000040400000-0x0000000040485000-memory.dmpFilesize
532KB
-
memory/2492-3-0x0000000000740000-0x0000000000790000-memory.dmpFilesize
320KB
-
memory/2492-1-0x0000000040400000-0x0000000040485000-memory.dmpFilesize
532KB
-
memory/2492-4-0x0000000000740000-0x0000000000790000-memory.dmpFilesize
320KB