Overview
overview
10Static
static
3RFQ-Al NAS...er.dll
windows10-2004-x64
1RFQ-Al NAS...st.dll
windows10-2004-x64
1RFQ-Al NAS...sc.dll
windows10-2004-x64
1RFQ-Al NAS...it.dll
windows10-2004-x64
1RFQ-Al NAS...nt.dll
windows7-x64
10RFQ-Al NAS...nt.dll
windows10-2004-x64
10RFQ-Al NAS...mu.dll
windows10-2004-x64
1RFQ-Al NAS...rs.dll
windows10-2004-x64
1RFQ-Al NAS...or.dll
windows10-2004-x64
1RFQ-Al NAS...sg.dll
windows10-2004-x64
1RFQ-Al NAS...AV.dll
windows10-2004-x64
1RFQ-Al NAS...er.dll
windows10-2004-x64
1RFQ-Al NAS...tp.dll
windows10-2004-x64
1RFQ-Al NAS...vc.dll
windows10-2004-x64
RFQ-Al NAS...om.dll
windows10-2004-x64
1RFQ-Al NAS...cs.dll
windows10-2004-x64
1RFQ-Al NAS...nt.dll
windows10-2004-x64
1RFQ-Al NAS...88.exe
windows10-2004-x64
10RFQ-Al NAS...lp.dll
windows10-2004-x64
1RFQ-Al NAS...50.dll
windows7-x64
1RFQ-Al NAS...50.dll
windows10-2004-x64
1Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-Al NASR-00388/AMMonitoringProvider.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
RFQ-Al NASR-00388/EppManifest.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
RFQ-Al NASR-00388/MpAsDesc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
RFQ-Al NASR-00388/MpAzSubmit.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RFQ-Al NASR-00388/MpClient.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
RFQ-Al NASR-00388/MpClient.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RFQ-Al NASR-00388/MpCommu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
RFQ-Al NASR-00388/MpDetours.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RFQ-Al NASR-00388/MpDetoursCopyAccelerator.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
RFQ-Al NASR-00388/MpEvMsg.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
RFQ-Al NASR-00388/MpOAV.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
RFQ-Al NASR-00388/MpProvider.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
RFQ-Al NASR-00388/MpRtp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
RFQ-Al NASR-00388/MpSvc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
RFQ-Al NASR-00388/MsMpCom.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
RFQ-Al NASR-00388/MsMpLics.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
RFQ-Al NASR-00388/ProtectionManagement.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
RFQ-Al NASR-00388/RFQ-Al NASR-00388.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
RFQ-Al NASR-00388/endpointdlp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
RFQ-Al NASR-00388/msvcp150.dll
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
RFQ-Al NASR-00388/msvcp150.dll
Resource
win10v2004-20240802-en
General
-
Target
RFQ-Al NASR-00388/msvcp150.dll
-
Size
2.5MB
-
MD5
b4b0085158f97323158ab8438782e550
-
SHA1
e78baa7f2a611486196aa64485a1d762b9f88323
-
SHA256
6840c478bf1a0d427d1c592d5a2074bc3d4d114d8951238e6c0ee5660cf37d00
-
SHA512
e88c88456ee9451cbcfa3732d725f54302bcd4228921057f571fc2c0d594f52a0786888c6a7ff539afeb8e89372bc845d7685353b321ee4ae331febb5d31f896
-
SSDEEP
49152:yHTk0p9NWVfn/gm5Ohdl8gFrW5uuSvTzVD:F8dSuuc
Malware Config
Signatures
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\RFQ-Al NASR-00388\msvcp150.dll",#11⤵PID:3924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3928,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:81⤵PID:996