Overview
overview
7Static
static
7288492de51...c4.exe
windows7-x64
3288492de51...c4.exe
windows10-2004-x64
3$PLUGINSDIR/AMIH.dll
windows7-x64
1$PLUGINSDIR/AMIH.dll
windows10-2004-x64
1$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...SC.dll
windows7-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3AMBattery.dll
windows7-x64
7AMBattery.dll
windows10-2004-x64
7ArgusContr...ce.exe
windows7-x64
7ArgusContr...ce.exe
windows10-2004-x64
7ArgusMonitor.exe
windows7-x64
7ArgusMonitor.exe
windows10-2004-x64
7ArgusNetHandler.exe
windows7-x64
7ArgusNetHandler.exe
windows10-2004-x64
7GpuControl.exe
windows7-x64
1GpuControl.exe
windows10-2004-x64
1HWInit.dll
windows7-x64
7HWInit.dll
windows10-2004-x64
7libusb-1.0.dll
windows7-x64
3libusb-1.0.dll
windows10-2004-x64
3Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 21:30
Behavioral task
behavioral1
Sample
288492de5197a9fa987cb4bc2463a93c5653e07a8bb0dc1d6bb31d620a26ecc4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
288492de5197a9fa987cb4bc2463a93c5653e07a8bb0dc1d6bb31d620a26ecc4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AMIH.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AMIH.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
AMBattery.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
AMBattery.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
ArgusControlService.exe
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
ArgusControlService.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
ArgusMonitor.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
ArgusMonitor.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
ArgusNetHandler.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
ArgusNetHandler.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
GpuControl.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
GpuControl.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
HWInit.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
HWInit.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
libusb-1.0.dll
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
libusb-1.0.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/SimpleSC.dll
-
Size
1.1MB
-
MD5
7b89329c6d8693fb2f6a4330100490a0
-
SHA1
851b605cdc1c390c4244db56659b6b9aa8abd22c
-
SHA256
1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
-
SHA512
ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
-
SSDEEP
12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4728 1984 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4248 wrote to memory of 1984 4248 rundll32.exe 91 PID 4248 wrote to memory of 1984 4248 rundll32.exe 91 PID 4248 wrote to memory of 1984 4248 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#12⤵PID:1984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 6363⤵
- Program crash
PID:4728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1984 -ip 19841⤵PID:456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵PID:4588