Overview
overview
10Static
static
3IMHttpComm.dll
windows7-x64
3IMHttpComm.dll
windows10-2004-x64
3ImLookExU.dll
windows7-x64
1ImLookExU.dll
windows10-2004-x64
1ImLookU.dll
windows7-x64
3ImLookU.dll
windows10-2004-x64
3ImNtUtilU.dll
windows7-x64
3ImNtUtilU.dll
windows10-2004-x64
3ImPackr.exe
windows7-x64
10ImPackr.exe
windows10-2004-x64
10ImUtilsU.dll
windows7-x64
3ImUtilsU.dll
windows10-2004-x64
3ImWrappU.dll
windows7-x64
1ImWrappU.dll
windows10-2004-x64
1SftTree_IX86_U_60.dll
windows7-x64
1SftTree_IX86_U_60.dll
windows10-2004-x64
1mfc80u.dll
windows7-x64
1mfc80u.dll
windows10-2004-x64
1msvcp80.dll
windows7-x64
1msvcp80.dll
windows10-2004-x64
1msvcr80.dll
windows7-x64
1msvcr80.dll
windows10-2004-x64
1wlessfp1.dll
windows7-x64
3wlessfp1.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 13:06
Static task
static1
Behavioral task
behavioral1
Sample
IMHttpComm.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
IMHttpComm.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
ImLookExU.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
ImLookExU.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
ImLookU.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
ImLookU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
ImNtUtilU.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
ImNtUtilU.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
ImPackr.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
ImPackr.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
ImUtilsU.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
ImUtilsU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
ImWrappU.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
ImWrappU.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
SftTree_IX86_U_60.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
SftTree_IX86_U_60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
mfc80u.dll
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
mfc80u.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
msvcp80.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
msvcp80.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
msvcr80.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
msvcr80.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
wlessfp1.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
wlessfp1.dll
Resource
win10v2004-20240611-en
General
-
Target
ImLookU.dll
-
Size
606KB
-
MD5
3ea6d805a18715f7368363dea3cd3f4c
-
SHA1
30ffafc1dd447172fa91404f07038d759c412464
-
SHA256
a6766c524497144d585efa4fe384b516b563203427003508f7c8f6bffa7c928d
-
SHA512
a102f23741de4ca2184485d9aa4ddd1a36b9ea52cb0859cfd264d69a9996293b7e29b325625f1f6f9330d6c80ff415e09e85e1ae838c58acef585ae8dffe3070
-
SSDEEP
6144:5hvkhcT5e0HWJ5/10UfCrXCL12gQhYwtHWDEyF0nb6rFBvJ+sbJeDH+8uGh7xgLX:5hvkhcTd2JxXCrS85h0Dh0nMKbz45
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3000 3004 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2252 wrote to memory of 3004 2252 rundll32.exe rundll32.exe PID 2252 wrote to memory of 3004 2252 rundll32.exe rundll32.exe PID 2252 wrote to memory of 3004 2252 rundll32.exe rundll32.exe PID 2252 wrote to memory of 3004 2252 rundll32.exe rundll32.exe PID 2252 wrote to memory of 3004 2252 rundll32.exe rundll32.exe PID 2252 wrote to memory of 3004 2252 rundll32.exe rundll32.exe PID 2252 wrote to memory of 3004 2252 rundll32.exe rundll32.exe PID 3004 wrote to memory of 3000 3004 rundll32.exe WerFault.exe PID 3004 wrote to memory of 3000 3004 rundll32.exe WerFault.exe PID 3004 wrote to memory of 3000 3004 rundll32.exe WerFault.exe PID 3004 wrote to memory of 3000 3004 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ImLookU.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ImLookU.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 4443⤵
- Program crash
PID:3000