Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-11-2024 12:51
General
-
Target
a27d0851d800424707d6e460d9564e6231c7b9ff56be2c64d27e6b5dca8e9ef3.dll
-
Size
6.5MB
-
MD5
da220581617c7b47ceaf253222e109d0
-
SHA1
b8765221bebe04dd7146e7fb84884e41060bbaa7
-
SHA256
a27d0851d800424707d6e460d9564e6231c7b9ff56be2c64d27e6b5dca8e9ef3
-
SHA512
2e19dcdc79aa09235d988f703b75a458d706549c83ec096e8adac526c553f6dca37dbbb217466a42e9dc4895cb5d2ffc1aad49433bdf74976d7aa11d570dbc02
-
SSDEEP
98304:OakfZx3+IN5v4D1NQ+bfrklMBZ1ZhUU+BaIqsnoIdKj5ZRcKpWIdKQ:Z8f3r5QlbffZ1zUHoBj5b/WBQ
Score
10/10
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
156.247.33.21 - Port:
21 - Username:
lz165404 - Password:
lz165404.
Signatures
-
Blocklisted process makes network request 2 IoCs
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a27d0851d800424707d6e460d9564e6231c7b9ff56be2c64d27e6b5dca8e9ef3.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
8KB