Overview
overview
10Static
static
3TaxOrganizer24.exe
windows7-x64
10TaxOrganizer24.exe
windows10-2004-x64
10libcrypto-1_1-x64.dll
windows7-x64
1libcrypto-1_1-x64.dll
windows10-2004-x64
1libcurl-4.dll
windows7-x64
1libcurl-4.dll
windows10-2004-x64
1libiconv-2.dll
windows7-x64
10libiconv-2.dll
windows10-2004-x64
10libintl-8.dll
windows7-x64
1libintl-8.dll
windows10-2004-x64
1libpcre2-8-0.dll
windows7-x64
1libpcre2-8-0.dll
windows10-2004-x64
1libssp-0.dll
windows7-x64
1libssp-0.dll
windows10-2004-x64
1msvcp144.dll
windows7-x64
4msvcp144.dll
windows10-2004-x64
4vcruntime211.dll
windows7-x64
1vcruntime211.dll
windows10-2004-x64
1zlib1.dll
windows7-x64
1zlib1.dll
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2025 09:58
Static task
static1
Behavioral task
behavioral1
Sample
TaxOrganizer24.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
TaxOrganizer24.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
libcrypto-1_1-x64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
libcrypto-1_1-x64.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
libcurl-4.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral6
Sample
libcurl-4.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
libiconv-2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
libiconv-2.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
libintl-8.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
libintl-8.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
libpcre2-8-0.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
libpcre2-8-0.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
libssp-0.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
libssp-0.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
msvcp144.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
msvcp144.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
vcruntime211.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
vcruntime211.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
zlib1.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
zlib1.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
General
-
Target
msvcp144.dll
-
Size
3.8MB
-
MD5
861908c05742756c7cd6ee22daec451b
-
SHA1
1686abfda1ea36ef9ea508d4516dfef1734a83ff
-
SHA256
128f96765d8b0f94922fcc7b79cce90cfde66f7aa835aaa6745d2ccb96471b42
-
SHA512
638252daf3fa5fc1eef85f9f3e30c8aec226ef8c593a00992f1bc3c4d3ffc961a1b119aed012317359af3ef9a883408fc429806225d313eced10219540882a33
-
SSDEEP
49152:Xo4jX82pc5kYFtjNgRBQEf7DwbyKslgFF6Z7Ye6+Kr:ZQ6yqws6Xr
Malware Config
Signatures
-
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\appvetwsharedperformance.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AppVStreamMap.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\bderepair.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_1141.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_20004.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dcomp.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AppVSentinel.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\blbres.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\DefaultDeviceManager.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BluetoothApis.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cldapi.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cmgrcspps.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_20269.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_866.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cryptuiwizard.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\d3d9on12.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ddrawex.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\basesrv.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dafpos.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dhcpcsvc.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cic.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\CredProvDataModel.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ddputils.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\devinv.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\authentication.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cdpusersvc.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AdmTmpl.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cdpsvc.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dabapi.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\catsrv.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\choice.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\comsnap.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\coredpussvr.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_1258.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_20285.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\DAFIoT.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\defragres.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\agentactivationruntime.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\authz.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\crypttpmeksvc.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cttune.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dinput8.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\chartv.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ConfigureExpandedStorage.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\configmanager2.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cttunesvr.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dafAspInfraProvider.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AppXApplicabilityBlob.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\@BackgroundAccessToastIcon.png rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AudioEndpointBuilder.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\bindfltapi.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ContactActivation.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_20127.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dhcpcsvc6.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AcWinRT.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\appvetwstreamingux.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AppVTerminator.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\DafGip.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\aeevts.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AppHostRegistrationVerifier.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\assignedaccessmanagersvc.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ClipSVC.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\credssp.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_20424.NLS rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2228 rundll32.exe