Overview
overview
10Static
static
3a7d2ea641d...ee.exe
windows7-x64
10a7d2ea641d...ee.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Absorbable.sul
windows7-x64
3Absorbable.sul
windows10-2004-x64
3Beskikning...ed.vin
windows7-x64
3Beskikning...ed.vin
windows10-2004-x64
3Beskikning...17.vgr
windows7-x64
3Beskikning...17.vgr
windows10-2004-x64
3Beskikning...ls.scr
windows7-x64
Beskikning...ls.scr
windows10-2004-x64
Beskikning...el.txt
windows7-x64
1Beskikning...el.txt
windows10-2004-x64
1Beskikning...et.ser
windows7-x64
3Beskikning...et.ser
windows10-2004-x64
3Beskikning...es.ref
windows7-x64
3Beskikning...es.ref
windows10-2004-x64
3Besttelsestropper.hov
windows7-x64
3Besttelsestropper.hov
windows10-2004-x64
3Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 13:35
Static task
static1
Behavioral task
behavioral1
Sample
a7d2ea641dbc8e50000e6b42c9cca200fa25d5e37ddd1857eb489795ab5564ee.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a7d2ea641dbc8e50000e6b42c9cca200fa25d5e37ddd1857eb489795ab5564ee.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Absorbable.sul
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
Absorbable.sul
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Beskikningers/Misaimed.vin
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Beskikningers/Misaimed.vin
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Beskikningers/Randon17.vgr
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
Beskikningers/Randon17.vgr
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Beskikningers/keelhauls.scr
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Beskikningers/keelhauls.scr
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Beskikningers/primaveksel.txt
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
Beskikningers/primaveksel.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Beskikningers/skohornet.ser
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
Beskikningers/skohornet.ser
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Beskikningers/temperatures.ref
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Beskikningers/temperatures.ref
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Besttelsestropper.hov
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
Besttelsestropper.hov
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
55a26d7800446f1373056064c64c3ce8
-
SHA1
80256857e9a0a9c8897923b717f3435295a76002
-
SHA256
904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
-
SHA512
04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
-
SSDEEP
192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4692 1900 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3048 wrote to memory of 1900 3048 rundll32.exe rundll32.exe PID 3048 wrote to memory of 1900 3048 rundll32.exe rundll32.exe PID 3048 wrote to memory of 1900 3048 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 6123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1900 -ip 19001⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:81⤵