Overview
overview
9Static
static
3gpg.exe
windows7-x64
1gpg.exe
windows10-2004-x64
1gpgconf.exe
windows7-x64
1gpgconf.exe
windows10-2004-x64
1libassuan-0.dll
windows7-x64
3libassuan-0.dll
windows10-2004-x64
3libgcrypt-20.dll
windows7-x64
1libgcrypt-20.dll
windows10-2004-x64
3libgpg-error-0.dll
windows7-x64
1libgpg-error-0.dll
windows10-2004-x64
1libnpth-0.dll
windows7-x64
1libnpth-0.dll
windows10-2004-x64
1libsqlite3-0.dll
windows7-x64
3libsqlite3-0.dll
windows10-2004-x64
3trkop.vbs
windows7-x64
9trkop.vbs
windows10-2004-x64
9zapa.bat
windows7-x64
7zapa.bat
windows10-2004-x64
1zlib1.dll
windows7-x64
3zlib1.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 16:07
Static task
static1
Behavioral task
behavioral1
Sample
gpg.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
gpg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
gpgconf.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
gpgconf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
libassuan-0.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
libassuan-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
libgcrypt-20.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
libgcrypt-20.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
libgpg-error-0.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
libgpg-error-0.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
libnpth-0.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
libnpth-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
libsqlite3-0.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
libsqlite3-0.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
trkop.vbs
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
trkop.vbs
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
zapa.bat
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
zapa.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
zlib1.dll
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
zlib1.dll
Resource
win10v2004-20240508-en
General
-
Target
libsqlite3-0.dll
-
Size
795KB
-
MD5
3cdc28af73770e4a3068a47c094c73df
-
SHA1
f2ee14b5bd6f156a16def829e85fe4d5ad791dfd
-
SHA256
9d5d08972b624e5ef9cd9cef6e9fed21cca7972df624c3248992b96974afa3ae
-
SHA512
a055d712f4874d6239107e2ccbd751fd2de3d6a5db5e5f510e1e51b0a28591f60c56b0d0c11074308ad2afb6edae65d76c8318cbd8eac9278fe472fedc4479a6
-
SSDEEP
12288:58LF0+BcKh68H8vMwHvF/Jkbh84dQ64Jns0xmQak/lVTNRGwhP444dZIEqGw6KQc:KdBZ84Wq0xda4jhAZZzZtn/giGbfAK
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2188 1588 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2196 wrote to memory of 1588 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 1588 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 1588 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 1588 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 1588 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 1588 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 1588 2196 rundll32.exe rundll32.exe PID 1588 wrote to memory of 2188 1588 rundll32.exe WerFault.exe PID 1588 wrote to memory of 2188 1588 rundll32.exe WerFault.exe PID 1588 wrote to memory of 2188 1588 rundll32.exe WerFault.exe PID 1588 wrote to memory of 2188 1588 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libsqlite3-0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libsqlite3-0.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 2243⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1588-0-0x0000000066580000-0x000000006664C000-memory.dmpFilesize
816KB