Overview
overview
10Static
static
10TotalAV.exe
windows7-x64
4TotalAV.exe
windows10-2004-x64
4$APPDATA/T...bb.dll
windows7-x64
1$APPDATA/T...bb.dll
windows10-2004-x64
1$APPDATA/T...re.dll
windows7-x64
3$APPDATA/T...re.dll
windows10-2004-x64
3$APPDATA/T...to.dll
windows7-x64
1$APPDATA/T...to.dll
windows10-2004-x64
1$APPDATA/T...id.dll
windows7-x64
1$APPDATA/T...id.dll
windows10-2004-x64
1$APPDATA/T...mu.dll
windows7-x64
1$APPDATA/T...mu.dll
windows10-2004-x64
1$APPDATA/T...xp.dll
windows7-x64
1$APPDATA/T...xp.dll
windows10-2004-x64
1$APPDATA/T...en.dll
windows7-x64
1$APPDATA/T...en.dll
windows10-2004-x64
1$APPDATA/T...lp.dll
windows7-x64
1$APPDATA/T...lp.dll
windows10-2004-x64
1$APPDATA/T...ur.dll
windows7-x64
1$APPDATA/T...ur.dll
windows10-2004-x64
1$APPDATA/T...nf.dll
windows7-x64
1$APPDATA/T...nf.dll
windows10-2004-x64
1$APPDATA/T...ml.dll
windows7-x64
1$APPDATA/T...ml.dll
windows10-2004-x64
1$APPDATA/T...le.dll
windows7-x64
1$APPDATA/T...le.dll
windows10-2004-x64
1$APPDATA/T...ce.dll
windows7-x64
1$APPDATA/T...ce.dll
windows10-2004-x64
1$APPDATA/T...ck.dll
windows7-x64
1$APPDATA/T...ck.dll
windows10-2004-x64
1$APPDATA/T...dl.dll
windows7-x64
1$APPDATA/T...dl.dll
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 17:34
Behavioral task
behavioral1
Sample
TotalAV.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TotalAV.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aebb.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aebb.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aecore.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aecore.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aecrypto.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aecrypto.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aedroid.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aedroid.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeemu.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeemu.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeexp.dll
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeexp.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aegen.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aegen.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aehelp.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aehelp.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeheur.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeheur.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aelibinf.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aelibinf.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeml.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeml.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aemobile.dll
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aemobile.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeoffice.dll
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeoffice.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aepack.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aepack.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral31
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aerdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aerdl.dll
Resource
win10v2004-20240419-en
General
-
Target
$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeemu.dll
-
Size
411KB
-
MD5
a77547ea30c7e99dbf395e2135d5ee55
-
SHA1
2383bfff89a586aae2a4e99072b5b740d7115240
-
SHA256
daf4f56cffc30b604d238df30e96332dba84447399597cc7bfb94ab02cddec63
-
SHA512
ab99353214ee63b3d89dab90722fd4026f76959e7e96085ac93a457f53df9378bfbd35ec33bf7aaee0870d0a7b8ecff4601b5b360465a60d10591204cf953eef
-
SSDEEP
12288:ATDo2ZqPL80e/tkut8TNPpCXKQN7f4w8TMf5DTCi5xSfkpW+KV79mgAs3n5GPo:A/o2ZqPL80e/tkut8TNPpCXKQN7f4w8f
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 2280 wrote to memory of 2204 2280 rundll32.exe 28 PID 2280 wrote to memory of 2204 2280 rundll32.exe 28 PID 2280 wrote to memory of 2204 2280 rundll32.exe 28 PID 2280 wrote to memory of 2204 2280 rundll32.exe 28 PID 2280 wrote to memory of 2204 2280 rundll32.exe 28 PID 2280 wrote to memory of 2204 2280 rundll32.exe 28 PID 2280 wrote to memory of 2204 2280 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aeemu.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aeemu.dll",#12⤵PID:2204
-