Overview
overview
7Static
static
3RTSSSetup736.exe
windows7-x64
7RTSSSetup736.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...st.dll
windows7-x64
3$PLUGINSDI...st.dll
windows10-2004-x64
3$PLUGINSDI...64.dll
windows7-x64
1$PLUGINSDI...64.dll
windows10-2004-x64
1$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$R0.dll
windows7-x64
1$R0.dll
windows10-2004-x64
1Codec/rtvcvfw32.dll
windows7-x64
1Codec/rtvcvfw32.dll
windows10-2004-x64
1DesktopOve...st.exe
windows7-x64
1DesktopOve...st.exe
windows10-2004-x64
1DesktopOve...er.exe
windows7-x64
3DesktopOve...er.exe
windows10-2004-x64
7EncoderServer.cfg
windows7-x64
3EncoderServer.cfg
windows10-2004-x64
3EncoderServer.exe
windows7-x64
1EncoderServer.exe
windows10-2004-x64
1EncoderServer64.exe
windows7-x64
1EncoderServer64.exe
windows10-2004-x64
1RTFC.dll
windows7-x64
3RTFC.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
RTSSSetup736.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
RTSSSetup736.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LockedList.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LockedList.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LockedList64.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LockedList64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$R0.dll
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
$R0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Codec/rtvcvfw32.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Codec/rtvcvfw32.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
DesktopOverlayHost.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
DesktopOverlayHost.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
DesktopOverlayHostLoader.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
DesktopOverlayHostLoader.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
EncoderServer.cfg
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
EncoderServer.cfg
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
EncoderServer.exe
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
EncoderServer.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
EncoderServer64.exe
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
EncoderServer64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
RTFC.dll
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
RTFC.dll
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/LockedList.dll
-
Size
28KB
-
MD5
84c93011c323095555fcfcbebab4df83
-
SHA1
69d6b67f1d73b9cda8397f8e0748b45c91987bd5
-
SHA256
cf1b3d307918e11f4c90888ef65f9cad0302eabf7235187eaad5764646874340
-
SHA512
c95008dce262608bee2bd2081d456a98e4a9d2814c0bfdd77c9a74394dd3aca373d57975d2c30be5f9af013772abed0a9b924a4e24e266110821147afa5e50e8
-
SSDEEP
768:on7n6hKdgWn9Cb22ryBD3fvMkGksfLqo7B:onWhKdne22ryBDvvMPne+
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2556 3044 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3040 wrote to memory of 3044 3040 rundll32.exe 28 PID 3040 wrote to memory of 3044 3040 rundll32.exe 28 PID 3040 wrote to memory of 3044 3040 rundll32.exe 28 PID 3040 wrote to memory of 3044 3040 rundll32.exe 28 PID 3040 wrote to memory of 3044 3040 rundll32.exe 28 PID 3040 wrote to memory of 3044 3040 rundll32.exe 28 PID 3040 wrote to memory of 3044 3040 rundll32.exe 28 PID 3044 wrote to memory of 2556 3044 rundll32.exe 29 PID 3044 wrote to memory of 2556 3044 rundll32.exe 29 PID 3044 wrote to memory of 2556 3044 rundll32.exe 29 PID 3044 wrote to memory of 2556 3044 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LockedList.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LockedList.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 2243⤵
- Program crash
PID:2556
-
-