Overview
overview
10Static
static
10133359336e...96.exe
windows10-2004-x64
7system.pyc
windows10-2004-x64
315b2fa0131...aa.zip
windows10-2004-x64
1IMHttpComm.dll
windows10-2004-x64
3ImLookExU.dll
windows10-2004-x64
1ImLookU.dll
windows10-2004-x64
3ImNtUtilU.dll
windows10-2004-x64
3ImPackr.exe
windows10-2004-x64
7ImUtilsU.dll
windows10-2004-x64
3ImWrappU.dll
windows10-2004-x64
1Microsoft....nifest
windows10-2004-x64
3Microsoft....nifest
windows10-2004-x64
3SftTree_IX86_U_60.dll
windows10-2004-x64
1chamiso.sql
windows10-2004-x64
3mfc80u.dll
windows10-2004-x64
1msvcp80.dll
windows10-2004-x64
1msvcr80.dll
windows10-2004-x64
1torpor.zip
windows10-2004-x64
1wlessfp1.dll
windows10-2004-x64
31dcf0f609f...f9.exe
windows10-2004-x64
5b76a896c8f...f7.exe
windows10-2004-x64
1Analysis
-
max time kernel
69s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 08:29
Behavioral task
behavioral1
Sample
133359336ed60b94e9cd500fb518a72fe8711c4a8f8fc83ef2cc242173d8cb96.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
system.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
15b2fa0131427a7fbffe42ce83f36357661772faa0381e6ab8ef21a81c6380aa.zip
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
IMHttpComm.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
ImLookExU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
ImLookU.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ImNtUtilU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral8
Sample
ImPackr.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
ImUtilsU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
ImWrappU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Microsoft.VC80.CRT.manifest
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
Microsoft.VC80.MFC.manifest
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
SftTree_IX86_U_60.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
chamiso.sql
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
mfc80u.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
msvcp80.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
msvcr80.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
torpor.zip
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
wlessfp1.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
1dcf0f609f8e6867fe4a7b49c97d5674fefe7a64fdb82de1fd819a3b96a8d8f9.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
b76a896c8faf8ca28e4f0ecce91e7a622c3ea8999f27503ac9f46e09542c26f7.exe
Resource
win10v2004-20240508-en
General
-
Target
msvcp80.dll
-
Size
536KB
-
MD5
4c8a880eabc0b4d462cc4b2472116ea1
-
SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6
-
SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
-
SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
-
SSDEEP
12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1564 wrote to memory of 748 1564 rundll32.exe rundll32.exe PID 1564 wrote to memory of 748 1564 rundll32.exe rundll32.exe PID 1564 wrote to memory of 748 1564 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp80.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp80.dll,#12⤵PID:748
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4472,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:81⤵PID:1036