Overview
overview
10Static
static
3RFQ-Al NAS...er.dll
windows10-2004-x64
1RFQ-Al NAS...st.dll
windows10-2004-x64
1RFQ-Al NAS...sc.dll
windows10-2004-x64
1RFQ-Al NAS...it.dll
windows10-2004-x64
1RFQ-Al NAS...nt.dll
windows7-x64
10RFQ-Al NAS...nt.dll
windows10-2004-x64
3RFQ-Al NAS...mu.dll
windows10-2004-x64
1RFQ-Al NAS...rs.dll
windows10-2004-x64
1RFQ-Al NAS...or.dll
windows10-2004-x64
1RFQ-Al NAS...sg.dll
windows10-2004-x64
1RFQ-Al NAS...AV.dll
windows10-2004-x64
1RFQ-Al NAS...er.dll
windows10-2004-x64
1RFQ-Al NAS...tp.dll
windows10-2004-x64
1RFQ-Al NAS...vc.dll
windows10-2004-x64
1RFQ-Al NAS...om.dll
windows10-2004-x64
1RFQ-Al NAS...cs.dll
windows10-2004-x64
1RFQ-Al NAS...nt.dll
windows10-2004-x64
1RFQ-Al NAS...88.exe
windows10-2004-x64
10RFQ-Al NAS...lp.dll
windows10-2004-x64
1RFQ-Al NAS...50.dll
windows7-x64
1RFQ-Al NAS...50.dll
windows10-2004-x64
1Analysis
- max time kernel
124s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
23/09/2024, 19:37
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-Al NASR-00388/AMMonitoringProvider.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral2
Sample
RFQ-Al NASR-00388/EppManifest.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
RFQ-Al NASR-00388/MpAsDesc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
RFQ-Al NASR-00388/MpAzSubmit.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RFQ-Al NASR-00388/MpClient.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
RFQ-Al NASR-00388/MpClient.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral7
Sample
RFQ-Al NASR-00388/MpCommu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
RFQ-Al NASR-00388/MpDetours.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RFQ-Al NASR-00388/MpDetoursCopyAccelerator.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
RFQ-Al NASR-00388/MpEvMsg.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
RFQ-Al NASR-00388/MpOAV.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
RFQ-Al NASR-00388/MpProvider.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
RFQ-Al NASR-00388/MpRtp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
RFQ-Al NASR-00388/MpSvc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
RFQ-Al NASR-00388/MsMpCom.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
RFQ-Al NASR-00388/MsMpLics.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
RFQ-Al NASR-00388/ProtectionManagement.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
RFQ-Al NASR-00388/RFQ-Al NASR-00388.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
RFQ-Al NASR-00388/endpointdlp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
RFQ-Al NASR-00388/msvcp150.dll
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
RFQ-Al NASR-00388/msvcp150.dll
Resource
win10v2004-20240802-en
General
- Target RFQ-Al NASR-00388/EppManifest.dll
- Size 1.0MB
- Sample240923-ybvvdayfmk
- SHA256 5768486507ce07e7c387e409714244fe2a96b33d1666d24825aa181ac3cef5bc
- MD5 e1414283b5fb25e3a0aa034104e187d3
- SHA1 ca6b4f68ee7a0b17072962f9d93bb10ecfb3a46f
- SHA512 ca79757602b50d82790e8583187e4a18b8a1b9e81a4ad4f1233e0cadab3fe8ca874cb1bef267953ab5a0b82f0df8392a10dab68129249af9a210068e384f8717
- SSDEEP 6144:qmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUVZVVVVVjVVJ2:4/6qa37L5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\RFQ-Al NASR-00388\EppManifest.dll",#11⤵PID:5104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:81⤵PID:3448