Overview
overview
7Static
static
3DVResolve-RPC.v1.0.7z
windows7-x64
7DVResolve-RPC.v1.0.7z
windows10-2004-x64
7DVResolve-...s.json
windows7-x64
3DVResolve-...s.json
windows10-2004-x64
3DVResolve-...PC.exe
windows7-x64
1DVResolve-...PC.exe
windows10-2004-x64
1DVResolve-...PC.exe
windows7-x64
1DVResolve-...PC.exe
windows10-2004-x64
1DVResolve-...PC.pdb
windows7-x64
3DVResolve-...PC.pdb
windows10-2004-x64
3DVResolve-...g.json
windows7-x64
3DVResolve-...g.json
windows10-2004-x64
3DVResolve-...PC.dll
windows7-x64
1DVResolve-...PC.dll
windows10-2004-x64
1DVResolve-...on.dll
windows7-x64
1DVResolve-...on.dll
windows10-2004-x64
1Analysis
-
max time kernel
0s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 21:31
Static task
static1
Behavioral task
behavioral1
Sample
DVResolve-RPC.v1.0.7z
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
DVResolve-RPC.v1.0.7z
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
DVResolve-RPC v1.0/DVResolve-RPC.deps.json
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
DVResolve-RPC v1.0/DVResolve-RPC.deps.json
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
DVResolve-RPC v1.0/DVResolve-RPC.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
DVResolve-RPC v1.0/DVResolve-RPC.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
DVResolve-RPC v1.0/DVResolve-RPC.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
DVResolve-RPC v1.0/DVResolve-RPC.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
DVResolve-RPC v1.0/DVResolve-RPC.pdb
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
DVResolve-RPC v1.0/DVResolve-RPC.pdb
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
DVResolve-RPC v1.0/DVResolve-RPC.runtimeconfig.json
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
DVResolve-RPC v1.0/DVResolve-RPC.runtimeconfig.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
DVResolve-RPC v1.0/DiscordRPC.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
DVResolve-RPC v1.0/DiscordRPC.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
DVResolve-RPC v1.0/Newtonsoft.Json.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
DVResolve-RPC v1.0/Newtonsoft.Json.dll
Resource
win10v2004-20240508-en
General
-
Target
DVResolve-RPC v1.0/DVResolve-RPC.deps.json
-
Size
3KB
-
MD5
7b9d0fa610c9a976592c8adb275f672f
-
SHA1
68f799baa3a8bab0f8fccc56d24dbe75517f9bb1
-
SHA256
9bde474baa957042c5348a2a7ce2d281e4388c8b54cd40c811d774aefb929dd1
-
SHA512
8592a10459beaf5d07172ae06db4b944879175d40eb96481836a833494ff8e5f32e42db65f9f3163086bab94bc8e84be4fb6b658f7389819994eefe0a6a34671
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2968 wrote to memory of 2688 2968 cmd.exe rundll32.exe PID 2968 wrote to memory of 2688 2968 cmd.exe rundll32.exe PID 2968 wrote to memory of 2688 2968 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\DVResolve-RPC v1.0\DVResolve-RPC.deps.json"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DVResolve-RPC v1.0\DVResolve-RPC.deps.json2⤵PID:2688
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DVResolve-RPC v1.0\DVResolve-RPC.deps.json"3⤵PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5bf7d95fccdcf3d0ecd7f76ce745ef86f
SHA190d4d76adf6c68debf2dd30b0b70ff9732e8b4bc
SHA256bb552e4a99c811f32acb293e5f57b899067fe3431e97d12a1d9f3ab3262dd945
SHA5128e44b96f6fd2d6e2621aada10b268afd4b1bd2eaead7508e9f9765472af87278dcac2203921ee7900e36c5830f955706ed18ab4870ba03e455edecd8e3d8d351