Overview
overview
7Static
static
73739d14235...4a.exe
windows11-21h2-x64
7$PLUGINSDI...ol.dll
windows11-21h2-x64
5$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...fo.dll
windows11-21h2-x64
3$PLUGINSDI...al.ini
windows11-21h2-x64
3$PLUGINSDI...er.bmp
windows11-21h2-x64
3$PLUGINSDI...rd.bmp
windows11-21h2-x64
3AVStrike.exe
windows11-21h2-x64
6AVStrike.exe.config
windows11-21h2-x64
3CButtonLib.dll
windows11-21h2-x64
1Common Tools.dll
windows11-21h2-x64
1Core.dll
windows11-21h2-x64
1Interop.IW...ry.dll
windows11-21h2-x64
1KernelBase.dll
windows11-21h2-x64
3LumenWorks...IO.dll
windows11-21h2-x64
1System.Dat...te.dll
windows11-21h2-x64
3TaskScheduler.dll
windows11-21h2-x64
1Uninstall.exe
windows11-21h2-x64
7$PLUGINSDI...em.dll
windows11-21h2-x64
3db/AVStrikeDB.ldb
windows11-21h2-x64
3db/AVStrikeDB.ldb.bak
windows11-21h2-x64
3db/bytecode.cld
windows11-21h2-x64
3db/daily.cld
windows11-21h2-x64
3db/main.cld
windows11-21h2-x64
3db/mirrors.dat
windows11-21h2-x64
3libclamav.dll
windows11-21h2-x64
3libclamavd.dll
windows11-21h2-x64
3log4net.dll
windows11-21h2-x64
1scandll.dll
windows11-21h2-x64
3update_db.exe
windows11-21h2-x64
Analysis
-
max time kernel
300s -
max time network
302s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
07/11/2024, 10:46
Behavioral task
behavioral1
Sample
3739d14235ff791ab9f138b769613880d3426004e42eb8c96da33cc00b18f14a.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241023-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
AVStrike.exe
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
AVStrike.exe.config
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
CButtonLib.dll
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
Common Tools.dll
Resource
win11-20241023-en
Behavioral task
behavioral13
Sample
Core.dll
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
Interop.IWshRuntimeLibrary.dll
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
KernelBase.dll
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
LumenWorks.Framework.IO.dll
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
System.Data.SQLite.dll
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
TaskScheduler.dll
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
Uninstall.exe
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
db/AVStrikeDB.ldb
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
db/AVStrikeDB.ldb.bak
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
db/bytecode.cld
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
db/daily.cld
Resource
win11-20241023-en
Behavioral task
behavioral25
Sample
db/main.cld
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
db/mirrors.dat
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
libclamav.dll
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
libclamavd.dll
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
log4net.dll
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
scandll.dll
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
update_db.exe
Resource
win11-20241007-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
c17103ae9072a06da581dec998343fc1
-
SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
-
SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
-
SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
SSDEEP
192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3144 4536 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4700 wrote to memory of 4536 4700 rundll32.exe 80 PID 4700 wrote to memory of 4536 4700 rundll32.exe 80 PID 4700 wrote to memory of 4536 4700 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 4603⤵
- Program crash
PID:3144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4536 -ip 45361⤵PID:3836