Overview
overview
7Static
static
3NoRiskClie...up.exe
windows10-2004-x64
7$PLUGINSDI...ID.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3NoRiskClient.exe
windows10-2004-x64
1redist/Mic...up.exe
windows10-2004-x64
6uninstall.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3Analysis
-
max time kernel
475s -
max time network
570s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
NoRiskClient-Windows-setup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240412-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral8
Sample
NoRiskClient.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
redist/MicrosoftEdgeWebview2Setup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral10
Sample
uninstall.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20240412-en
General
-
Target
$PLUGINSDIR/StartMenu.dll
-
Size
7KB
-
MD5
d070f3275df715bf3708beff2c6c307d
-
SHA1
93d3725801e07303e9727c4369e19fd139e69023
-
SHA256
42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
-
SHA512
fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
-
SSDEEP
96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4296 2980 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3840 wrote to memory of 2980 3840 rundll32.exe rundll32.exe PID 3840 wrote to memory of 2980 3840 rundll32.exe rundll32.exe PID 3840 wrote to memory of 2980 3840 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 6123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2980 -ip 29801⤵