Overview
overview
10Static
static
3InstaIler.exe
windows10-1703-x64
10amsvcp120.dll
windows10-1703-x64
3dll/libEGL.dll
windows10-1703-x64
1dll/ssleay32.dll
windows10-1703-x64
1files/libs...re.dll
windows10-1703-x64
3files/libs/libEGL.dll
windows10-1703-x64
1files/libs...32.dll
windows10-1703-x64
1files/libs...20.dll
windows10-1703-x64
3files/libs...20.dll
windows10-1703-x64
3files/libs...sw.dll
windows10-1703-x64
1files/libs...32.dll
windows10-1703-x64
1files/libs...it.dll
windows10-1703-x64
1files/libs/wsepno.dll
windows10-1703-x64
1files/libs/wshbth.dll
windows10-1703-x64
1files/libs/wshcon.dll
windows10-1703-x64
7Analysis
-
max time kernel
91s -
max time network
84s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25/04/2024, 16:27
Static task
static1
Behavioral task
behavioral1
Sample
InstaIler.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
amsvcp120.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
dll/libEGL.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
dll/ssleay32.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
files/libs/Qt5Core.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
files/libs/libEGL.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
files/libs/libeay32.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
files/libs/msvcp120.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
files/libs/msvcr120.dll
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
files/libs/opengl32sw.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
files/libs/ssleay32.dll
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
files/libs/wsecedit.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
files/libs/wsepno.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
files/libs/wshbth.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
files/libs/wshcon.dll
Resource
win10-20240404-en
General
-
Target
files/libs/opengl32sw.dll
-
Size
14.5MB
-
MD5
3bd5aea364326cdfa667651a93e7a4c9
-
SHA1
f33b4a83e038363c1a4df919e6f6e0e41dba9334
-
SHA256
23f04ba936568e9a7c9dce7a6beb52c9be7eb13b734cd390c99e7546cbe1973d
-
SHA512
7bd4e742b4d683b79de54eaf7d8b215252212921b8a53d1fbfc8e51ce43505c003da62fd126663bc04bbc65b8f77b85232c78ea6ecba8a4e425c28c0e9c80dc3
-
SSDEEP
393216:00Rly5ZnSHLe1tvwDTtwJuefdrX780dNYbg4A358TjGNrS1aKbBICZBSJLGWIGC2:NRlyP71tvwDTtwJuefdrX780dNYbg4Az
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 792 rundll32.exe 792 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2848 xpsrchvw.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 792 rundll32.exe 792 rundll32.exe 792 rundll32.exe 792 rundll32.exe 792 rundll32.exe 792 rundll32.exe 792 rundll32.exe 792 rundll32.exe 792 rundll32.exe 2848 xpsrchvw.exe 2848 xpsrchvw.exe 2848 xpsrchvw.exe 2848 xpsrchvw.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3764 wrote to memory of 792 3764 rundll32.exe 72 PID 3764 wrote to memory of 792 3764 rundll32.exe 72 PID 3764 wrote to memory of 792 3764 rundll32.exe 72
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\files\libs\opengl32sw.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\files\libs\opengl32sw.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:792
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2820
-
C:\Windows\System32\xpsrchvw.exe"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\StartRestore.xps"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2848