Overview
overview
10Static
static
10133359336e...96.exe
windows10-2004-x64
7system.pyc
windows10-2004-x64
315b2fa0131...aa.zip
windows10-2004-x64
1IMHttpComm.dll
windows10-2004-x64
3ImLookExU.dll
windows10-2004-x64
1ImLookU.dll
windows10-2004-x64
3ImNtUtilU.dll
windows10-2004-x64
3ImPackr.exe
windows10-2004-x64
7ImUtilsU.dll
windows10-2004-x64
3ImWrappU.dll
windows10-2004-x64
1Microsoft....nifest
windows10-2004-x64
3Microsoft....nifest
windows10-2004-x64
3SftTree_IX86_U_60.dll
windows10-2004-x64
1chamiso.sql
windows10-2004-x64
3mfc80u.dll
windows10-2004-x64
1msvcp80.dll
windows10-2004-x64
1msvcr80.dll
windows10-2004-x64
1torpor.zip
windows10-2004-x64
1wlessfp1.dll
windows10-2004-x64
31dcf0f609f...f9.exe
windows10-2004-x64
5b76a896c8f...f7.exe
windows10-2004-x64
1Analysis
-
max time kernel
62s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 08:29
Behavioral task
behavioral1
Sample
133359336ed60b94e9cd500fb518a72fe8711c4a8f8fc83ef2cc242173d8cb96.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
system.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
15b2fa0131427a7fbffe42ce83f36357661772faa0381e6ab8ef21a81c6380aa.zip
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
IMHttpComm.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
ImLookExU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
ImLookU.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ImNtUtilU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral8
Sample
ImPackr.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
ImUtilsU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
ImWrappU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Microsoft.VC80.CRT.manifest
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
Microsoft.VC80.MFC.manifest
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
SftTree_IX86_U_60.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
chamiso.sql
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
mfc80u.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
msvcp80.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
msvcr80.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
torpor.zip
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
wlessfp1.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
1dcf0f609f8e6867fe4a7b49c97d5674fefe7a64fdb82de1fd819a3b96a8d8f9.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
b76a896c8faf8ca28e4f0ecce91e7a622c3ea8999f27503ac9f46e09542c26f7.exe
Resource
win10v2004-20240508-en
General
-
Target
SftTree_IX86_U_60.dll
-
Size
570KB
-
MD5
57bf106e5ec51b703b83b69a402dc39f
-
SHA1
bd4cfab7c50318607326504cc877c0bc84ef56ef
-
SHA256
24f2399fc83198ab8d63ee6a1ad6ffbd1eda4d38048d3e809fecd2a3e0709671
-
SHA512
8bf60649ece6bbb66c7b94ed0d9214fbeab030d5813e1e7b5d6d2349ee1de9075b7dfbbbbeae5af0dc21b071a00eafce0771ca1804e6752e9a71e71e6b1447df
-
SSDEEP
6144:+F1oCaK7hWLMxQqTxNEaPe/cq0sJBJYzlRtcChgWPQnjLkV3Ij9DvAmintVM:koxK7hhNN1m/cq0sJ/YzNcCj0oVy8Y
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1748 wrote to memory of 3504 1748 rundll32.exe rundll32.exe PID 1748 wrote to memory of 3504 1748 rundll32.exe rundll32.exe PID 1748 wrote to memory of 3504 1748 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SftTree_IX86_U_60.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SftTree_IX86_U_60.dll,#12⤵PID:3504
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2708,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:81⤵PID:4012