rundll
Behavioral task
behavioral1
Sample
90bf3f854c210f30e0b57b78330e62c611d00a444c904bb792c56e426a9e2671.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
90bf3f854c210f30e0b57b78330e62c611d00a444c904bb792c56e426a9e2671.dll
Resource
win10v2004-20240226-en
General
-
Target
d24d4a54a0e40828860629adfda75b6c5bd5737a518f6440133711ed56df2a22
-
Size
6KB
-
MD5
7272b1623ab0b8e5dc74b8adcfcb8f51
-
SHA1
a2123c662e274ec5e357b77f9012545732a6d65c
-
SHA256
d24d4a54a0e40828860629adfda75b6c5bd5737a518f6440133711ed56df2a22
-
SHA512
bef5963c808a518e0e4cc8039db199f304794963f393b8f271bcee14119aa7fd15249fb667c565bdff312e8f1cc2c151b323feb50f6a63620f0342aabb0a18db
-
SSDEEP
192:KUH0mLFjSHnypx0o/ff0bUhZ8yppe28U9Ys3guG:KUHSeDfswhZ8ySyYYM
Malware Config
Extracted
systembc
88.214.25.251:41827
192.168.1.28:41827
Signatures
-
Systembc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/90bf3f854c210f30e0b57b78330e62c611d00a444c904bb792c56e426a9e2671
Files
-
d24d4a54a0e40828860629adfda75b6c5bd5737a518f6440133711ed56df2a22.zip
Password: infected
-
90bf3f854c210f30e0b57b78330e62c611d00a444c904bb792c56e426a9e2671.dll windows:5 windows x64 arch:x64
dbd4201cf48f9c38a17d30012392cf92
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
user32
wsprintfA
ws2_32
getaddrinfo
closesocket
shutdown
send
setsockopt
freeaddrinfo
recv
WSAIoctl
select
connect
inet_ntoa
inet_addr
htons
ioctlsocket
WSAStartup
socket
advapi32
GetTokenInformation
OpenProcessToken
GetSidSubAuthority
kernel32
WriteFile
SetFilePointer
CreateFileA
VirtualFree
GetCurrentProcess
SetEvent
SystemTimeToFileTime
ExitThread
CloseHandle
CreateThread
LocalAlloc
GetTempPathA
GetVolumeInformationA
VirtualAlloc
Sleep
LocalFree
WaitForSingleObject
FileTimeToSystemTime
GetLocalTime
CreateEventA
secur32
GetUserNameExA
GetUserNameExW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Exports
Exports
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 398B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ