Overview
overview
10Static
static
10ScanGuard_Setup.exe
windows11-21h2-x64
$APPDATA/S...te.exe
windows11-21h2-x64
1$APPDATA/S...io.dll
windows11-21h2-x64
3$APPDATA/S...lt.sys
windows11-21h2-x64
1$APPDATA/S...bb.sys
windows11-21h2-x64
1$APPDATA/S...gr.sys
windows11-21h2-x64
1$APPDATA/S...io.dll
windows11-21h2-x64
3$APPDATA/S...lt.sys
windows11-21h2-x64
1$APPDATA/S...bb.sys
windows11-21h2-x64
1$APPDATA/S...gr.sys
windows11-21h2-x64
$APPDATA/S...io.dll
windows11-21h2-x64
3$APPDATA/S...lt.sys
windows11-21h2-x64
1$APPDATA/S...bb.sys
windows11-21h2-x64
1$APPDATA/S...gr.sys
windows11-21h2-x64
1$APPDATA/S...io.dll
windows11-21h2-x64
3$APPDATA/S...lt.sys
windows11-21h2-x64
1Microsoft....cs.dll
windows11-21h2-x64
1Microsoft....es.dll
windows11-21h2-x64
1Microsoft....er.dll
windows11-21h2-x64
1Microsoft.CSharp.dll
windows11-21h2-x64
1Microsoft....86.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....er.dll
windows11-21h2-x64
1Microsoft....on.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....on.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....ng.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....es.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....re.dll
windows11-21h2-x64
1Resubmissions
10-07-2024 23:05
240710-223vfsvemm 10Analysis
-
max time kernel
1785s -
max time network
1792s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-07-2024 23:05
Behavioral task
behavioral1
Sample
ScanGuard_Setup.exe
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/avupdate.exe
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win7/avgio.dll
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.sys
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.sys
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.sys
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win8/avgio.dll
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.sys
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.sys
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.sys
Resource
win11-20240709-en
Behavioral task
behavioral11
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win7/avgio.dll
Resource
win11-20240709-en
Behavioral task
behavioral12
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.sys
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.sys
Resource
win11-20240709-en
Behavioral task
behavioral14
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.sys
Resource
win11-20240709-en
Behavioral task
behavioral15
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win8/avgio.dll
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.sys
Resource
win11-20240709-en
Behavioral task
behavioral17
Sample
Microsoft.AppCenter.Analytics.dll
Resource
win11-20240709-en
Behavioral task
behavioral18
Sample
Microsoft.AppCenter.Crashes.dll
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
Microsoft.AppCenter.dll
Resource
win11-20240709-en
Behavioral task
behavioral20
Sample
Microsoft.CSharp.dll
Resource
win11-20240709-en
Behavioral task
behavioral21
Sample
Microsoft.DiaSymReader.Native.x86.dll
Resource
win11-20240709-en
Behavioral task
behavioral22
Sample
Microsoft.Extensions.Configuration.Abstractions.dll
Resource
win11-20240709-en
Behavioral task
behavioral23
Sample
Microsoft.Extensions.Configuration.Binder.dll
Resource
win11-20240709-en
Behavioral task
behavioral24
Sample
Microsoft.Extensions.Configuration.dll
Resource
win11-20240709-en
Behavioral task
behavioral25
Sample
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Resource
win11-20240709-en
Behavioral task
behavioral26
Sample
Microsoft.Extensions.DependencyInjection.dll
Resource
win11-20240709-en
Behavioral task
behavioral27
Sample
Microsoft.Extensions.Logging.Abstractions.dll
Resource
win11-20240709-en
Behavioral task
behavioral28
Sample
Microsoft.Extensions.Logging.dll
Resource
win11-20240709-en
Behavioral task
behavioral29
Sample
Microsoft.Extensions.Options.dll
Resource
win11-20240709-en
Behavioral task
behavioral30
Sample
Microsoft.Extensions.Primitives.dll
Resource
win11-20240709-en
Behavioral task
behavioral31
Sample
Microsoft.Toolkit.Uwp.Notifications.dll
Resource
win11-20240709-en
Behavioral task
behavioral32
Sample
Microsoft.VisualBasic.Core.dll
Resource
win11-20240709-en
General
-
Target
Microsoft.VisualBasic.Core.dll
-
Size
1.1MB
-
MD5
4ca0c139b698ff4b1a4fbaf653d8b607
-
SHA1
4881028e15d3fe3e52a6e0e8a10a3d926f3400d3
-
SHA256
e0864f46e0f0ca66143b43c12a4b37dbe2fbe8fd138d5da59326fd632d6a3571
-
SHA512
db0e1eea47f75bde5427234888d88829fb184e31be0aefcf687e2dd4e351d9daa7cd5fdc5457ac445f17c5f784f4602f48fa8f49faa2c22c511729c5f550b93f
-
SSDEEP
24576:92o6FIAG8DgwIB0RLQh71gPOpxEDoQt7g8m:f6FjDgwAps2Itto
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4244 wrote to memory of 1324 4244 rundll32.exe rundll32.exe PID 4244 wrote to memory of 1324 4244 rundll32.exe rundll32.exe PID 4244 wrote to memory of 1324 4244 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.VisualBasic.Core.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.VisualBasic.Core.dll,#12⤵PID:1324
-