Overview
overview
8Static
static
37zxa.dll
windows7-x64
37zxa.dll
windows10-2004-x64
3BLOCKBUSTER.dll
windows7-x64
1BLOCKBUSTER.dll
windows10-2004-x64
1BLOCKBUSTER.exe
windows7-x64
8BLOCKBUSTER.exe
windows10-2004-x64
8hcx.dll
windows7-x64
3hcx.dll
windows10-2004-x64
3unrar.dll
windows7-x64
3unrar.dll
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 16:58
Static task
static1
Behavioral task
behavioral1
Sample
7zxa.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7zxa.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
BLOCKBUSTER.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
BLOCKBUSTER.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
BLOCKBUSTER.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
BLOCKBUSTER.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
hcx.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
hcx.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
unrar.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
unrar.dll
Resource
win10v2004-20241007-en
General
-
Target
7zxa.dll
-
Size
74.9MB
-
MD5
7debcf459eda4083f84755ebf4f86b2e
-
SHA1
836415a2569edece9d171eb5466e2937cd6ac968
-
SHA256
34aba14b155a63db5f40ca0784104bc1003c5098752c52e726ee34d51bfabbdb
-
SHA512
607b39c4836c408db19a8739c44af1da0b39398b009c356162fbef28faeb4cd8ae811dcffbdf3b20b411376e45593cfabb34a83f3b8f3c8a30cb576d29d9f63b
-
SSDEEP
393216:FN6KVjMOasRE0Sepz8A6AUPattEG2aEUbwi5iHEJIa5yJBz7h8zxPtYLx5mYfAHb:Vj0X3A2z5H8IaIp8zxtYd5mYfc
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1820 2592 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2592 rundll32.exe 2592 rundll32.exe 2592 rundll32.exe 2592 rundll32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2592 rundll32.exe 2592 rundll32.exe 2592 rundll32.exe 2592 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2592 2040 rundll32.exe 85 PID 2040 wrote to memory of 2592 2040 rundll32.exe 85 PID 2040 wrote to memory of 2592 2040 rundll32.exe 85 PID 2592 wrote to memory of 112 2592 rundll32.exe 88 PID 2592 wrote to memory of 112 2592 rundll32.exe 88 PID 2592 wrote to memory of 112 2592 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7zxa.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7zxa.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Query /TN "rundll32"3⤵
- System Location Discovery: System Language Discovery
PID:112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 10523⤵
- Program crash
PID:1820
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2592 -ip 25921⤵PID:4608