Analysis

  • max time kernel
    83s
  • max time network
    86s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-04-2024 01:33

General

  • Target

    SharinganAgent.dll

  • Size

    27KB

  • MD5

    e98ddc9fe2c416b86ec35deeba49a3a2

  • SHA1

    de41bb07c42651ab0a7e26bec6661ed3c31aef9b

  • SHA256

    b4eb0d76afcd3ef586df6296730f417f71faf9ec8d582c3c4b08e6b4d29e2e36

  • SHA512

    b2ffb741d435f9fead9704e7ab4eacca6e35a80cf5672181be1870f7350bae299b2d08cb25f1ef4511d972700917212a5dd9ea6eda8ea02945a21dfb89ff5696

  • SSDEEP

    384:jGU5cDT+QW7ZExn0ejMtnI88H4aqheUWI9m0WkuwJNajXYpmdGUcjxSpQPgZ1ifr:6i7m+eSI1HfqhsIQpwvxpmGoyYOfD

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SharinganAgent.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\SharinganAgent.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads