bab8b5e74ab7210b030316dd5685f3fdcceac35bd3b3a90e5dd01592f8abb630 | Triage

Analysis

max time kernel
125s
max time network
145s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
23-06-2024 13:01

Sharing

Report Analysis Logs

General

Target

natives/Nursultan.dll
Size

130.9MB
MD5

677fade82777815bfa26725e136d3791
SHA1

3ede1c959e60cca82c44a8124eba232b24efb63c
SHA256

97fd7c6ad118abc2af2b5454c7aeae413ecd21dae7be66830e30b5dd09d6b1e4
SHA512

8b005413ea6b1163ba056cac618012513abe745505ca50df0d145666cf2deb6b4d0db132b352cc7c62538b9295aefb83fa200492143487be83cc7dd3dceeb346
SSDEEP

3145728:sxez3Uijs5lAL/k13DD6Dw5jIDjjr2n0JBM5b8A1Ks6:s631js5l+uH6DwjIDjjc0UOA4

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2680	rundll32.exe
2680	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2680	rundll32.exe
2680	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\natives\Nursultan.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-0-0x00007FFDFC250000-0x00007FFDFC252000-memory.dmp

Filesize
8KB

Download
memory/2680-1-0x00007FFDFC260000-0x00007FFDFC262000-memory.dmp

Filesize
8KB

Download
memory/2680-2-0x00007FFDBF4C0000-0x00007FFDC04C0000-memory.dmp

Filesize
16.0MB

Download