Overview
overview
3Static
static
3ollydbg-sc...ec.dll
windows7-x64
1ollydbg-sc...ec.dll
windows10-2004-x64
3ollydbg-sc...0.1.js
windows7-x64
3ollydbg-sc...0.1.js
windows10-2004-x64
3ArmaDetach.dll
windows7-x64
1ArmaDetach.dll
windows10-2004-x64
1ArmaDetach.exe
windows7-x64
1ArmaDetach.exe
windows10-2004-x64
1ArmaFP.exe
windows7-x64
1ArmaFP.exe
windows10-2004-x64
1ArmInline.exe
windows7-x64
1ArmInline.exe
windows10-2004-x64
1Disasm.dll
windows7-x64
3Disasm.dll
windows10-2004-x64
1NanoView.exe
windows7-x64
1NanoView.exe
windows10-2004-x64
1Nanolib.dll
windows7-x64
3Nanolib.dll
windows10-2004-x64
3ArmaCRCStd.exe
windows7-x64
1ArmaCRCStd.exe
windows10-2004-x64
1DllLoader.exe
windows7-x64
1DllLoader.exe
windows10-2004-x64
1dilloDIE.exe
windows7-x64
1dilloDIE.exe
windows10-2004-x64
1DllLoader.exe
windows7-x64
1DllLoader.exe
windows10-2004-x64
1dilloDIE.exe
windows7-x64
1dilloDIE.exe
windows10-2004-x64
1ollydbg-sc...en.exe
windows7-x64
1ollydbg-sc...en.exe
windows10-2004-x64
1ollydbg-sc...ck.dll
windows7-x64
1ollydbg-sc...ck.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 23:25
Static task
static1
Behavioral task
behavioral1
Sample
ollydbg-script-master/Armadillo/ARImpRec.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ollydbg-script-master/Armadillo/ARImpRec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
ollydbg-script-master/Armadillo/Armadillo 9.64 unpack script version. 0.1.js
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
ollydbg-script-master/Armadillo/Armadillo 9.64 unpack script version. 0.1.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
ArmaDetach.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
ArmaDetach.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ArmaDetach.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
ArmaDetach.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
ArmaFP.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
ArmaFP.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
ArmInline.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
ArmInline.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Disasm.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Disasm.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
NanoView.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
NanoView.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Nanolib.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Nanolib.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
ArmaCRCStd.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
ArmaCRCStd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
DllLoader.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
DllLoader.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
dilloDIE.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
dilloDIE.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
DllLoader.exe
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
DllLoader.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
dilloDIE.exe
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
dilloDIE.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/filelen.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/filelen.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/mbunpack.dll
Resource
win7-20240215-en
Behavioral task
behavioral32
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/mbunpack.dll
Resource
win10v2004-20240426-en
General
-
Target
ollydbg-script-master/Armadillo/ARImpRec.dll
-
Size
204KB
-
MD5
814ca983955e019c14d3048bb4d23d41
-
SHA1
a3d4459f8b3a2e5d1b2c092fa2d277ddb67cec33
-
SHA256
20af561bd1de340076f6ab0dd677bdd1d61a0ceb239c4c6361941106cf8d4620
-
SHA512
b88114f92979b48f26cc3fc6eb81b566fb05e580f29e4896326187d4831487f6b57fed99ea60056b0b3ef7096f2c329fbf59db45f053df651d07f2e3ba92c360
-
SSDEEP
3072:SZCt5jcRQP58902q2Ajrm3/6RP8pGuZeacSQnHORFywejvoGzfaxQchTBfN4Ivj+:0JR4EoTrXCWvNzCx5hTBVzj
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1564 wrote to memory of 1928 1564 rundll32.exe 28 PID 1564 wrote to memory of 1928 1564 rundll32.exe 28 PID 1564 wrote to memory of 1928 1564 rundll32.exe 28 PID 1564 wrote to memory of 1928 1564 rundll32.exe 28 PID 1564 wrote to memory of 1928 1564 rundll32.exe 28 PID 1564 wrote to memory of 1928 1564 rundll32.exe 28 PID 1564 wrote to memory of 1928 1564 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\Armadillo\ARImpRec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\Armadillo\ARImpRec.dll,#12⤵PID:1928
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2468