Overview
overview
10Static
static
3RFQ-Al NAS...er.dll
windows10-2004-x64
1RFQ-Al NAS...st.dll
windows10-2004-x64
1RFQ-Al NAS...sc.dll
windows10-2004-x64
1RFQ-Al NAS...it.dll
windows10-2004-x64
1RFQ-Al NAS...nt.dll
windows7-x64
10RFQ-Al NAS...nt.dll
windows10-2004-x64
3RFQ-Al NAS...mu.dll
windows10-2004-x64
1RFQ-Al NAS...rs.dll
windows10-2004-x64
1RFQ-Al NAS...or.dll
windows10-2004-x64
1RFQ-Al NAS...sg.dll
windows10-2004-x64
1RFQ-Al NAS...AV.dll
windows10-2004-x64
1RFQ-Al NAS...er.dll
windows10-2004-x64
1RFQ-Al NAS...tp.dll
windows10-2004-x64
1RFQ-Al NAS...vc.dll
windows10-2004-x64
1RFQ-Al NAS...om.dll
windows10-2004-x64
1RFQ-Al NAS...cs.dll
windows10-2004-x64
1RFQ-Al NAS...nt.dll
windows10-2004-x64
1RFQ-Al NAS...88.exe
windows10-2004-x64
10RFQ-Al NAS...lp.dll
windows10-2004-x64
1RFQ-Al NAS...50.dll
windows7-x64
1RFQ-Al NAS...50.dll
windows10-2004-x64
1Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2024 19:37
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-Al NASR-00388/AMMonitoringProvider.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral2
Sample
RFQ-Al NASR-00388/EppManifest.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
RFQ-Al NASR-00388/MpAsDesc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
RFQ-Al NASR-00388/MpAzSubmit.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RFQ-Al NASR-00388/MpClient.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
RFQ-Al NASR-00388/MpClient.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral7
Sample
RFQ-Al NASR-00388/MpCommu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
RFQ-Al NASR-00388/MpDetours.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RFQ-Al NASR-00388/MpDetoursCopyAccelerator.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
RFQ-Al NASR-00388/MpEvMsg.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
RFQ-Al NASR-00388/MpOAV.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
RFQ-Al NASR-00388/MpProvider.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
RFQ-Al NASR-00388/MpRtp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
RFQ-Al NASR-00388/MpSvc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
RFQ-Al NASR-00388/MsMpCom.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
RFQ-Al NASR-00388/MsMpLics.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
RFQ-Al NASR-00388/ProtectionManagement.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
RFQ-Al NASR-00388/RFQ-Al NASR-00388.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
RFQ-Al NASR-00388/endpointdlp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
RFQ-Al NASR-00388/msvcp150.dll
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
RFQ-Al NASR-00388/msvcp150.dll
Resource
win10v2004-20240802-en
General
-
Target
RFQ-Al NASR-00388/MpOAV.dll
-
Size
484KB
-
MD5
394c2ecad239aa887188a7c8fdfc44b8
-
SHA1
0cc4f07cd5c2989efcd35f730a3690f9d1540a73
-
SHA256
f79c12abba8c5850906cb4d69a5b7f274786a7a4f6dcd94740c37fdf7fe0f290
-
SHA512
04171b4706d9ef3956635ed2d80ddacfef4e0396573af0da56b614dc821b2f5bf4ace94c26f1151636ee3732dbccba9a8d46fe6349950a4fe05c482494b1b636
-
SSDEEP
6144:uzNxZHzwalKMy0kdi2b5zQTubTU1LhqJULrin5CJVA/miTVVmVVV8VVNVVVcVVVi:uZxekAbhQTMU1tqJULraeA9N
Malware Config
Signatures
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\RFQ-Al NASR-00388\MpOAV.dll"1⤵PID:1424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4396,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:81⤵PID:2816