Overview
overview
7Static
static
382f26b74d7...25.exe
windows7-x64
782f26b74d7...25.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffMediaWat...ion.js
windows7-x64
3ffMediaWat...ion.js
windows10-2004-x64
3ff/chrome/...067.js
windows7-x64
3ff/chrome/...067.js
windows10-2004-x64
3ff/chrome/...ion.js
windows7-x64
3ff/chrome/...ion.js
windows10-2004-x64
3ie/MediaWa...67.dll
windows7-x64
6ie/MediaWa...67.dll
windows10-2004-x64
6uninstall.exe
windows7-x64
3uninstall.exe
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 23:16
Static task
static1
Behavioral task
behavioral1
Sample
82f26b74d78f2505b962f422407afcfd9d1447ee2a6b99d43ec7c735a32fa225.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
82f26b74d78f2505b962f422407afcfd9d1447ee2a6b99d43ec7c735a32fa225.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
ffMediaWatchV1home3067chaction.js
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
ffMediaWatchV1home3067chaction.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ff/chrome/content/ffMediaWatchV1home3067.js
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
ff/chrome/content/ffMediaWatchV1home3067.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
ff/chrome/content/ffMediaWatchV1home3067ffaction.js
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
ff/chrome/content/ffMediaWatchV1home3067ffaction.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
ie/MediaWatchV1home3067.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
ie/MediaWatchV1home3067.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win10v2004-20240611-en
General
-
Target
$PLUGINSDIR/aminsis.dll
-
Size
559KB
-
MD5
51ba1095f0ae45a2d444bea506cb9ad4
-
SHA1
038a5d53d055a6d440bd2c8864c2f51db206c5e5
-
SHA256
b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
-
SHA512
f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
-
SSDEEP
12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3220 4952 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4780 wrote to memory of 4952 4780 rundll32.exe rundll32.exe PID 4780 wrote to memory of 4952 4780 rundll32.exe rundll32.exe PID 4780 wrote to memory of 4952 4780 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 6243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4952 -ip 49521⤵