Overview
overview
7Static
static
382f26b74d7...25.exe
windows7-x64
782f26b74d7...25.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffMediaWat...ion.js
windows7-x64
3ffMediaWat...ion.js
windows10-2004-x64
3ff/chrome/...067.js
windows7-x64
3ff/chrome/...067.js
windows10-2004-x64
3ff/chrome/...ion.js
windows7-x64
3ff/chrome/...ion.js
windows10-2004-x64
3ie/MediaWa...67.dll
windows7-x64
6ie/MediaWa...67.dll
windows10-2004-x64
6uninstall.exe
windows7-x64
3uninstall.exe
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 23:16
Static task
static1
Behavioral task
behavioral1
Sample
82f26b74d78f2505b962f422407afcfd9d1447ee2a6b99d43ec7c735a32fa225.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
82f26b74d78f2505b962f422407afcfd9d1447ee2a6b99d43ec7c735a32fa225.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
ffMediaWatchV1home3067chaction.js
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
ffMediaWatchV1home3067chaction.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ff/chrome/content/ffMediaWatchV1home3067.js
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
ff/chrome/content/ffMediaWatchV1home3067.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
ff/chrome/content/ffMediaWatchV1home3067ffaction.js
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
ff/chrome/content/ffMediaWatchV1home3067ffaction.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
ie/MediaWatchV1home3067.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
ie/MediaWatchV1home3067.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win10v2004-20240611-en
General
-
Target
$PLUGINSDIR/aminsis.dll
-
Size
559KB
-
MD5
51ba1095f0ae45a2d444bea506cb9ad4
-
SHA1
038a5d53d055a6d440bd2c8864c2f51db206c5e5
-
SHA256
b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
-
SHA512
f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
-
SSDEEP
12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2544 1732 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1848 wrote to memory of 1732 1848 rundll32.exe rundll32.exe PID 1848 wrote to memory of 1732 1848 rundll32.exe rundll32.exe PID 1848 wrote to memory of 1732 1848 rundll32.exe rundll32.exe PID 1848 wrote to memory of 1732 1848 rundll32.exe rundll32.exe PID 1848 wrote to memory of 1732 1848 rundll32.exe rundll32.exe PID 1848 wrote to memory of 1732 1848 rundll32.exe rundll32.exe PID 1848 wrote to memory of 1732 1848 rundll32.exe rundll32.exe PID 1732 wrote to memory of 2544 1732 rundll32.exe WerFault.exe PID 1732 wrote to memory of 2544 1732 rundll32.exe WerFault.exe PID 1732 wrote to memory of 2544 1732 rundll32.exe WerFault.exe PID 1732 wrote to memory of 2544 1732 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 2203⤵
- Program crash