Overview

overview

8

Static

static

3

MTS_Remote...64.exe

windows10-2004-x64

8

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

bin/7za.exe

windows10-2004-x64

1

bin/ViGEmClient.dll

windows10-2004-x64

1

bin/archive.dll

windows10-2004-x64

1

bin/locales/mr.ps1

windows10-2004-x64

3

bin/lz4.dll

windows10-2004-x64

1

bin/miniupnpc.dll

windows10-2004-x64

1

bin/msvcp140.dll

windows10-2004-x64

1

bin/msvcp140_1.dll

windows10-2004-x64

1

bin/msvcp140_2.dll

windows10-2004-x64

1

bin/msvcp1...it.dll

windows10-2004-x64

1

bin/msvcp1...ds.dll

windows10-2004-x64

1

bin/resour...x.html

windows10-2004-x64

1

bin/resour...7bd.js

windows10-2004-x64

3

bin/resour...8ec.js

windows10-2004-x64

3

bin/sentry.dll

windows10-2004-x64

1

bin/sqlite3.dll

windows10-2004-x64

1

bin/tesseract53.dll

windows10-2004-x64

1

bin/tiff.dll

windows10-2004-x64

1

bin/turbojpeg.dll

windows10-2004-x64

1

bin/vcruntime140.dll

windows10-2004-x64

1

bin/vcrunt..._1.dll

windows10-2004-x64

1

bin/vk_swi...er.dll

windows10-2004-x64

1

bin/vulkan-1.dll

windows10-2004-x64

1

bin/zlib1.dll

windows10-2004-x64

1

bin/zstd.dll

windows10-2004-x64

1

tmp/ViGEmB...64.msi

windows10-2004-x64

6

Resubmissions

16/06/2024, 18:21 UTC

240616-wzfn9avhrn 7

16/06/2024, 17:48 UTC

240616-wdm67s1alg 8

Analysis

  • max time kernel
    1776s
  • max time network
    1175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 17:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PLUGINSDIR/InstallOptions.dll

  • Size

    15KB

  • MD5

    ece25721125d55aa26cdfe019c871476

  • SHA1

    b87685ae482553823bf95e73e790de48dc0c11ba

  • SHA256

    c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

  • SHA512

    4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

  • SSDEEP

    384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
      2⤵
        PID:2364
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 636
          3⤵
          • Program crash
          PID:3604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2364 -ip 2364
      1⤵
        PID:3512

      Network

      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
      • flag-us
        DNS
        133.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        237.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.197.79.204.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        43.58.199.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.58.199.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        194.61.62.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        194.61.62.23.in-addr.arpa
        IN PTR
        Response
        194.61.62.23.in-addr.arpa
        IN PTR
        a23-62-61-194deploystaticakamaitechnologiescom
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        140.71.91.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        140.71.91.104.in-addr.arpa
        IN PTR
        Response
        140.71.91.104.in-addr.arpa
        IN PTR
        a104-91-71-140deploystaticakamaitechnologiescom
      • flag-us
        DNS
        82.90.14.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        82.90.14.23.in-addr.arpa
        IN PTR
        Response
        82.90.14.23.in-addr.arpa
        IN PTR
        a23-14-90-82deploystaticakamaitechnologiescom
      • flag-us
        DNS
        11.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        11.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        63.141.182.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        63.141.182.52.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.237:443
        g.bing.com
        tls
        2.5kB
         9.0kB
         19
        17
      • 23.62.61.194:443
        www.bing.com
        tls
        1.5kB
         5.4kB
         17
        12
      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.237
        13.107.21.237

      • 8.8.8.8:53
        133.32.126.40.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        133.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        237.197.79.204.in-addr.arpa
        dns
        73 B
         143 B
         1
        1

        DNS Request

        237.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        43.58.199.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        43.58.199.20.in-addr.arpa

      • 8.8.8.8:53
        194.61.62.23.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        194.61.62.23.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        140.71.91.104.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        140.71.91.104.in-addr.arpa

      • 8.8.8.8:53
        82.90.14.23.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        82.90.14.23.in-addr.arpa

      • 8.8.8.8:53
        11.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        11.227.111.52.in-addr.arpa

      • 8.8.8.8:53
        63.141.182.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        63.141.182.52.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.