Overview
overview
3Static
static
3ollydbg-sc...ec.dll
windows7-x64
1ollydbg-sc...ec.dll
windows10-2004-x64
3ollydbg-sc...0.1.js
windows7-x64
3ollydbg-sc...0.1.js
windows10-2004-x64
3ArmaDetach.dll
windows7-x64
1ArmaDetach.dll
windows10-2004-x64
1ArmaDetach.exe
windows7-x64
1ArmaDetach.exe
windows10-2004-x64
1ArmaFP.exe
windows7-x64
1ArmaFP.exe
windows10-2004-x64
1ArmInline.exe
windows7-x64
1ArmInline.exe
windows10-2004-x64
1Disasm.dll
windows7-x64
3Disasm.dll
windows10-2004-x64
1NanoView.exe
windows7-x64
1NanoView.exe
windows10-2004-x64
1Nanolib.dll
windows7-x64
3Nanolib.dll
windows10-2004-x64
3ArmaCRCStd.exe
windows7-x64
1ArmaCRCStd.exe
windows10-2004-x64
1DllLoader.exe
windows7-x64
1DllLoader.exe
windows10-2004-x64
1dilloDIE.exe
windows7-x64
1dilloDIE.exe
windows10-2004-x64
1DllLoader.exe
windows7-x64
1DllLoader.exe
windows10-2004-x64
1dilloDIE.exe
windows7-x64
1dilloDIE.exe
windows10-2004-x64
1ollydbg-sc...en.exe
windows7-x64
1ollydbg-sc...en.exe
windows10-2004-x64
1ollydbg-sc...ck.dll
windows7-x64
1ollydbg-sc...ck.dll
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 23:25
Static task
static1
Behavioral task
behavioral1
Sample
ollydbg-script-master/Armadillo/ARImpRec.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ollydbg-script-master/Armadillo/ARImpRec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
ollydbg-script-master/Armadillo/Armadillo 9.64 unpack script version. 0.1.js
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
ollydbg-script-master/Armadillo/Armadillo 9.64 unpack script version. 0.1.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
ArmaDetach.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
ArmaDetach.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ArmaDetach.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
ArmaDetach.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
ArmaFP.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
ArmaFP.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
ArmInline.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
ArmInline.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Disasm.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Disasm.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
NanoView.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
NanoView.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Nanolib.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Nanolib.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
ArmaCRCStd.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
ArmaCRCStd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
DllLoader.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
DllLoader.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
dilloDIE.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
dilloDIE.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
DllLoader.exe
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
DllLoader.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
dilloDIE.exe
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
dilloDIE.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/filelen.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/filelen.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/mbunpack.dll
Resource
win7-20240215-en
Behavioral task
behavioral32
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/mbunpack.dll
Resource
win10v2004-20240426-en
General
-
Target
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/mbunpack.dll
-
Size
147KB
-
MD5
684150ba77ca90fa6fdf405a848b2c7f
-
SHA1
ef3d69ea443b9b7d2742418a1207eea62b5d5500
-
SHA256
3fa5d1235af2b53c17a7dce32f19f663e2bfb84efeffebb32f7285a5555335a8
-
SHA512
c3c4972ead42383b646926ff422fe353b14c43ee01f235c544d44acb8b7dee7e4ff7a905d3fac70c62b7296e393dd06c7d68392313ec518b1a55fe95fc849720
-
SSDEEP
3072:e0I29s4CurXqp83OPe8y5fDdHglgQHBhMN9EmygwYCDkx+Is8pGGW0:lHt1rapedRDdHgllbCFtwrDkZpTW
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4932 wrote to memory of 3780 4932 rundll32.exe 83 PID 4932 wrote to memory of 3780 4932 rundll32.exe 83 PID 4932 wrote to memory of 3780 4932 rundll32.exe 83 PID 3780 wrote to memory of 4804 3780 rundll32.exe 86 PID 3780 wrote to memory of 4804 3780 rundll32.exe 86 PID 3780 wrote to memory of 4804 3780 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\MoleBox\MoleBox 2.xx Auto-Unpacker diy by:heiketian10\mbunpack.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\MoleBox\MoleBox 2.xx Auto-Unpacker diy by:heiketian10\mbunpack.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c mkdir ".\!UNPACKED!" 2> nul > nul3⤵PID:4804
-
-