7ee418f0f9a52187976c4e7ccaa0325379d6fd8713d1efdf4c243e37434d2b84 | Triage

Analysis

max time kernel
128s
max time network
138s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23/07/2024, 15:20

Sharing

Report Analysis Logs

General

Target

natives/Nursultan.dll
Size

130.9MB
MD5

677fade82777815bfa26725e136d3791
SHA1

3ede1c959e60cca82c44a8124eba232b24efb63c
SHA256

97fd7c6ad118abc2af2b5454c7aeae413ecd21dae7be66830e30b5dd09d6b1e4
SHA512

8b005413ea6b1163ba056cac618012513abe745505ca50df0d145666cf2deb6b4d0db132b352cc7c62538b9295aefb83fa200492143487be83cc7dd3dceeb346
SSDEEP

3145728:sxez3Uijs5lAL/k13DD6Dw5jIDjjr2n0JBM5b8A1Ks6:s631js5l+uH6DwjIDjjc0UOA4

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1128	rundll32.exe
1128	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1128	rundll32.exe
1128	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\natives\Nursultan.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-0-0x00007FF8E0AA0000-0x00007FF8E0AA2000-memory.dmp

Filesize
8KB

Download
memory/1128-1-0x00007FF8E0AB0000-0x00007FF8E0AB2000-memory.dmp

Filesize
8KB

Download
memory/1128-2-0x00007FF8AA1C0000-0x00007FF8AB1C0000-memory.dmp

Filesize
16.0MB

Download