Overview
overview
10Static
static
101 PROCESO...AL.exe
windows7-x64
1001 PROCESO...AL.exe
windows10-2004-x64
1001 PROCESO...c_.dll
windows7-x64
101 PROCESO...c_.dll
windows10-2004-x64
101 PROCESO...m_.dll
windows7-x64
101 PROCESO...m_.dll
windows10-2004-x64
101 PROCESO...t_.dll
windows7-x64
101 PROCESO...t_.dll
windows10-2004-x64
101 PROCESO...ep.rar
windows7-x64
301 PROCESO...ep.rar
windows10-2004-x64
301 PROCESO...20.dll
windows7-x64
101 PROCESO...20.dll
windows10-2004-x64
101 PROCESO...ia.yml
windows7-x64
301 PROCESO...ia.yml
windows10-2004-x64
301 PROCESO...20.dll
windows7-x64
101 PROCESO...20.dll
windows10-2004-x64
101 PROCESO...20.dll
windows7-x64
301 PROCESO...20.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 22:28
Static task
static1
Behavioral task
behavioral1
Sample
01 PROCESO JUDICIAL/01 PROCESO JUDICIAL.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
01 PROCESO JUDICIAL/01 PROCESO JUDICIAL.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
01 PROCESO JUDICIAL/madbasic_.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
01 PROCESO JUDICIAL/madbasic_.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
01 PROCESO JUDICIAL/maddisAsm_.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
01 PROCESO JUDICIAL/maddisAsm_.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
01 PROCESO JUDICIAL/madexcept_.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
01 PROCESO JUDICIAL/madexcept_.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
01 PROCESO JUDICIAL/onestep.rar
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
01 PROCESO JUDICIAL/onestep.rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
01 PROCESO JUDICIAL/rtl120.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
01 PROCESO JUDICIAL/rtl120.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
01 PROCESO JUDICIAL/urticaria.yml
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
01 PROCESO JUDICIAL/urticaria.yml
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
01 PROCESO JUDICIAL/vcl120.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
01 PROCESO JUDICIAL/vcl120.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
01 PROCESO JUDICIAL/vclx120.dll
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
01 PROCESO JUDICIAL/vclx120.dll
Resource
win10v2004-20240508-en
General
-
Target
01 PROCESO JUDICIAL/maddisAsm_.dll
-
Size
63KB
-
MD5
ef3b47b2ea3884914c13c778ff29eb5b
-
SHA1
dc2b1fa7c7547d8f1ad3f20f9060f7bc686118e0
-
SHA256
475f7cdffd8ed4d6f52bd98ae2bb684f1c923a1be2a692757a9af788a39b1d87
-
SHA512
9648d951d8d3640436c8029fd0f06786f7ff8f52191cd6959569c87868bb6c40ac8c7e495c09377a8a5c85e8d3942551c37eb84e916b5c16327d8d43a167820e
-
SSDEEP
1536:eNy3eqMne0sXB0IWtCLwEJhY0w1K7fixStj7wyis:CqMnfIB04LwEJhY0w1K7zzj
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1364 wrote to memory of 2032 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 2032 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 2032 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 2032 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 2032 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 2032 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 2032 1364 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\01 PROCESO JUDICIAL\maddisAsm_.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\01 PROCESO JUDICIAL\maddisAsm_.dll",#12⤵PID:2032