9f19d03371f1d63949545bcc0e9c4e702a6e97c53b26a707957243496a5a34b1 | Triage

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 04:32

Sharing

Report Analysis Logs

General

Target

libcurl64.dll
Size

134KB
MD5

8f3e91147e9880a0ce7c103ee1110f53
SHA1

4e7931b612419f0c0d7a5c43d47bdbe8dcf14baf
SHA256

8075d70fcfb6b376f01636452dc2d782a3f08564698c2313fbf03cc60268f404
SHA512

c213633375a1c7128a6b9f05c4791ecb5deaf2fe1aad76283e98af396fc3fe587d4d7fc29f2bebe962e9b0287a61ce2ea77e51b718cd27cbc4c95c2da399a2f6
SSDEEP

3072:Jf0QTRrlA3OgzrpFLITXa4j6eumRYQTyaMK/VM:iDhxea4j6sYKK

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
27.124.45.155
Port:
21
Username:
lz165404
Password:
lz165404.

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	3044	rundll32.exe
3	3044	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl64.dll,#1
1⤵
- Blocklisted process makes network request
PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-1-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download