Overview
overview
10Static
static
9Exec/Exec/....1.exe
windows10-1703-x64
10Exec/Exec/...32.dll
windows10-1703-x64
3Exec/Exec/...32.lib
windows10-1703-x64
3Exec/Exec/...wp.dll
windows10-1703-x64
1Exec/Exec/...uwpver
windows10-1703-x64
1Exec/Exec/...ff.bin
windows10-1703-x64
3Exec/Exec/...offver
windows10-1703-x64
1Exec/Exec/...on.txt
windows10-1703-x64
1Exec/Exec/...ts.dll
windows10-1703-x64
1Analysis
-
max time kernel
304s -
max time network
1580s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19-05-2024 01:09
Behavioral task
behavioral1
Sample
Exec/Exec/Release Executor V3.1.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Exec/Exec/dll/VMProtectSDK32.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Exec/Exec/dll/VMProtectSDK32.lib
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Exec/Exec/dll/celeryuwp.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Exec/Exec/dll/celeryuwpver
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Exec/Exec/dll/uwpoff.bin
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Exec/Exec/dll/uwpoffver
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Exec/Exec/dll/uwpversion.txt
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Exec/Exec/scripts/scripts.dll
Resource
win10-20240404-en
General
-
Target
Exec/Exec/dll/celeryuwp.dll
-
Size
4.2MB
-
MD5
b0f566fc20de341e2848a489f69a4e48
-
SHA1
7a81ab4c68ddeb1e0a83c37e17286ae53e29c334
-
SHA256
5223f453b44be5d13f5f249f1f23b020b75c7e237c23712d97813c430015afc6
-
SHA512
4ba8394bede49de1dd1ad98afa59e0546b5118cf6b75dcf2cc83f00fde88bda0d659944c3324d19960d935d9e29e69f8b9b08fa5d5db7f71506e13471bbcb75f
-
SSDEEP
49152:LikvPpFjV8b8bhnNcZXGDQc6jg8mHdnYvLyv5ttr24Y4AxYWAF7yWGxmR/qSDQey:0ZXGU7k8Ol5/24PqNmOQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3524 wrote to memory of 692 3524 rundll32.exe rundll32.exe PID 3524 wrote to memory of 692 3524 rundll32.exe rundll32.exe PID 3524 wrote to memory of 692 3524 rundll32.exe rundll32.exe