Overview
overview
3Static
static
3ollydbg-sc...ec.dll
windows7-x64
1ollydbg-sc...ec.dll
windows10-2004-x64
3ollydbg-sc...0.1.js
windows7-x64
3ollydbg-sc...0.1.js
windows10-2004-x64
3ArmaDetach.dll
windows7-x64
1ArmaDetach.dll
windows10-2004-x64
1ArmaDetach.exe
windows7-x64
1ArmaDetach.exe
windows10-2004-x64
1ArmaFP.exe
windows7-x64
1ArmaFP.exe
windows10-2004-x64
1ArmInline.exe
windows7-x64
1ArmInline.exe
windows10-2004-x64
1Disasm.dll
windows7-x64
3Disasm.dll
windows10-2004-x64
1NanoView.exe
windows7-x64
1NanoView.exe
windows10-2004-x64
1Nanolib.dll
windows7-x64
3Nanolib.dll
windows10-2004-x64
3ArmaCRCStd.exe
windows7-x64
1ArmaCRCStd.exe
windows10-2004-x64
1DllLoader.exe
windows7-x64
1DllLoader.exe
windows10-2004-x64
1dilloDIE.exe
windows7-x64
1dilloDIE.exe
windows10-2004-x64
1DllLoader.exe
windows7-x64
1DllLoader.exe
windows10-2004-x64
1dilloDIE.exe
windows7-x64
1dilloDIE.exe
windows10-2004-x64
1ollydbg-sc...en.exe
windows7-x64
1ollydbg-sc...en.exe
windows10-2004-x64
1ollydbg-sc...ck.dll
windows7-x64
1ollydbg-sc...ck.dll
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 23:25
Static task
static1
Behavioral task
behavioral1
Sample
ollydbg-script-master/Armadillo/ARImpRec.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
ollydbg-script-master/Armadillo/ARImpRec.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ollydbg-script-master/Armadillo/Armadillo 9.64 unpack script version. 0.1.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
ollydbg-script-master/Armadillo/Armadillo 9.64 unpack script version. 0.1.js
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ArmaDetach.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
ArmaDetach.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ArmaDetach.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral8
Sample
ArmaDetach.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ArmaFP.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
ArmaFP.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ArmInline.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
ArmInline.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Disasm.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
Disasm.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
NanoView.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral16
Sample
NanoView.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Nanolib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
Nanolib.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ArmaCRCStd.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral20
Sample
ArmaCRCStd.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
DllLoader.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
DllLoader.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
dilloDIE.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
dilloDIE.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
DllLoader.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral26
Sample
DllLoader.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
dilloDIE.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
dilloDIE.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by：heiketian10/filelen.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral30
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by：heiketian10/filelen.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by：heiketian10/mbunpack.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral32
Sample
ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by：heiketian10/mbunpack.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
ArmaDetach.dll
-
Size
5KB
-
MD5
b5ee7f1006d347deeffeb8569eb48d96
-
SHA1
544c76f21ede2782b787b8e4fb26754d64db8d81
-
SHA256
4eff066d97e605559c6bb10820c542ede46a9be7a1b331e8138875f86ef7f9f1
-
SHA512
1731ddb8aac7058381d1c9fea8c94c13c2ceefaf199888373ff2cb99ae62d4f5161e35484dcadd95a379d39ffdf44e62136a12f4077ca44b97695ccd727291be
-
SSDEEP
48:qizP9Ruqkl0CLMUaapfev6zIGEI3j+HpfLVxyr8odvVewv1EU5cz9l7XdZ:zP92LMUFpmSko3QpBxSVe52GjZ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2052 2084 rundll32.exe 28 PID 2084 wrote to memory of 2052 2084 rundll32.exe 28 PID 2084 wrote to memory of 2052 2084 rundll32.exe 28 PID 2084 wrote to memory of 2052 2084 rundll32.exe 28 PID 2084 wrote to memory of 2052 2084 rundll32.exe 28 PID 2084 wrote to memory of 2052 2084 rundll32.exe 28 PID 2084 wrote to memory of 2052 2084 rundll32.exe 28