Overview
overview
10Static
static
7Conficker ...BC.dll
windows7-x64
8Conficker ...BC.dll
windows10-2004-x64
1Conficker ...1E.dll
windows7-x64
8Conficker ...1E.dll
windows10-2004-x64
8Conficker ...A5.dll
windows7-x64
8Conficker ...A5.dll
windows10-2004-x64
7Conficker ...B6.dll
windows7-x64
8Conficker ...B6.dll
windows10-2004-x64
7Conficker ...B6.dll
windows7-x64
8Conficker ...B6.dll
windows10-2004-x64
7Conficker ...9D.dll
windows7-x64
7Conficker ...9D.dll
windows10-2004-x64
7Conficker ...65.dll
windows7-x64
8Conficker ...65.dll
windows10-2004-x64
7Conficker ...a5.dll
windows7-x64
8Conficker ...a5.dll
windows10-2004-x64
7Conficker ...sq.dll
windows7-x64
10Conficker ...sq.dll
windows10-2004-x64
10Conficker ...q4.dll
windows7-x64
10Conficker ...q4.dll
windows10-2004-x64
10Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 07:37
Behavioral task
behavioral1
Sample
Conficker binaries/1DB5476C766555C9995B25D19F97B9BC.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Conficker binaries/1DB5476C766555C9995B25D19F97B9BC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Conficker binaries/223D8089F8EE82F8B05266BAECAAC61E.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Conficker binaries/223D8089F8EE82F8B05266BAECAAC61E.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Conficker binaries/BD35D4D98FCBB1EC0E090FD2C631BAA5.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Conficker binaries/BD35D4D98FCBB1EC0E090FD2C631BAA5.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Conficker binaries/CE18A72735FEB7A315B947DC0986009D.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
Conficker binaries/CE18A72735FEB7A315B947DC0986009D.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
Conficker binaries/D9CB288F317124A0E63E3405ED290765.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Conficker binaries/D9CB288F317124A0E63E3405ED290765.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
Conficker binaries/bd35d4d98fcbb1ec0e090fd2c631baa5.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Conficker binaries/bd35d4d98fcbb1ec0e090fd2c631baa5.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
Conficker binaries/jwgkvsq.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Conficker binaries/jwgkvsq.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Conficker binaries/jwgkvsq4.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Conficker binaries/jwgkvsq4.dll
Resource
win10v2004-20240508-en
General
-
Target
Conficker binaries/1DB5476C766555C9995B25D19F97B9BC.dll
-
Size
84KB
-
MD5
1db5476c766555c9995b25d19f97b9bc
-
SHA1
f509f352e4ee0f8d8ee2902721ae3a15799baba1
-
SHA256
02137e9426258e8d1186dc21ee344ffc5cdb3f068a6600ba1897fd9d27ccba43
-
SHA512
229badb4811990e692444bf93cf804cef087ea4333292d26cea4aeeb63e40d8d0780cf9b9663bb0c4dcdf2e9f15d24ccee80a4d236718475aeb0700adb6a2701
-
SSDEEP
1536:4dlWJX+NT6wCg8JShVJs2t/D35mDVg7P5j3eOUWOjgxNWQTTprOh/eJwKeUodu5:dX/oK27guP57exW3DTpvEUod
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4920 wrote to memory of 3516 4920 rundll32.exe 85 PID 4920 wrote to memory of 3516 4920 rundll32.exe 85 PID 4920 wrote to memory of 3516 4920 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\1DB5476C766555C9995B25D19F97B9BC.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\1DB5476C766555C9995B25D19F97B9BC.dll",#12⤵PID:3516
-