Analysis
-
max time kernel
136s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 22:13
Static task
static1
Behavioral task
behavioral1
Sample
boom.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
boom.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$TEMP/robalos.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral6
Sample
$TEMP/robalos.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
$TEMP/robalos.dll
-
Size
65KB
-
MD5
fcf117a8a010022fba35633cfa14dd22
-
SHA1
8a5ab7602b5806c6b6b68eaabb4969665b282a08
-
SHA256
6db156d7c07f73dc674ef4e17c08fba01b6f983e50e032019dade58057c7da34
-
SHA512
e4592a99682eccbe7fe7175d74ffabd6848f472789445e59abe5b005f306c8a203cb9d6ee985cdcd9020870b58b5c8b0739f6bbeac86427e3e117a5fa0631b34
-
SSDEEP
1536:WdaHzgo0WJCdr/1niEOSkS50JJLJ4hHou2JqUjEjmay:WdsrDm5iEOWWJ9Za
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 388 1564 WerFault.exe 90 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe 1564 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3884 wrote to memory of 1564 3884 rundll32.exe 90 PID 3884 wrote to memory of 1564 3884 rundll32.exe 90 PID 3884 wrote to memory of 1564 3884 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\robalos.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\robalos.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 5443⤵
- Program crash
PID:388
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4016,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:81⤵PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1564 -ip 15641⤵PID:1392