Overview
overview
7Static
static
3Multi-Acco...er.zip
windows7-x64
1Multi-Acco...er.zip
windows10-2004-x64
1MapiProxy.dll
windows7-x64
5MapiProxy.dll
windows10-2004-x64
5MapiProxy_InUse.dll
windows7-x64
5MapiProxy_InUse.dll
windows10-2004-x64
5Multi-Checker.exe
windows7-x64
7Multi-Checker.exe
windows10-2004-x64
7NiceRAT.pyc
windows7-x64
3NiceRAT.pyc
windows10-2004-x64
3libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1libotr.dll
windows7-x64
1libotr.dll
windows10-2004-x64
1libssp-0.dll
windows7-x64
1libssp-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
292s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 19:27
Behavioral task
behavioral1
Sample
Multi-Account_checker.zip
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Multi-Account_checker.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
MapiProxy.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
MapiProxy.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
MapiProxy_InUse.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
MapiProxy_InUse.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Multi-Checker.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
Multi-Checker.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
NiceRAT.pyc
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
NiceRAT.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
libEGL.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
libGLESv2.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
libGLESv2.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
libotr.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
libotr.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
libssp-0.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
libssp-0.dll
Resource
win10v2004-20240226-en
General
-
Target
libssp-0.dll
-
Size
143KB
-
MD5
ca7cbabd77dd37ccf19b48e4ef535ed3
-
SHA1
3c2d16f2cd4ca7669c002b0f9feecfb7cdcf8587
-
SHA256
f1487940e58cef3b7cc5e165875ddb717baac4d6a88af92827ca3b7c6306fda4
-
SHA512
0377b182fd771620daae8c887133736466192e4081ca2b0d3f0c567998e0218e1be5aea533226e8b49c1449650460c7c01c7a2cff8ca4e5067a3f1dc88dc4212
-
SSDEEP
1536:6oM0J/Fh0/tcD5FLXsrtD9UEqagFdlxPX:HP8tcDbAR0rFdj
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 2556 wrote to memory of 2828 2556 rundll32.exe 28 PID 2556 wrote to memory of 2828 2556 rundll32.exe 28 PID 2556 wrote to memory of 2828 2556 rundll32.exe 28