Overview
overview
9Static
static
7Fix+Licens...re.dll
windows7-x64
1Fix+Licens...re.dll
windows10-2004-x64
1Fix+Licens...EN.exe
windows7-x64
9Fix+Licens...EN.exe
windows10-2004-x64
9Join Teleg...re.url
windows7-x64
1Join Teleg...re.url
windows10-2004-x64
1binaryninj...64.exe
windows7-x64
4binaryninj...64.exe
windows10-2004-x64
4$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Qt6Core.dll
windows7-x64
1Qt6Core.dll
windows10-2004-x64
1Qt6Gui.dll
windows7-x64
1Qt6Gui.dll
windows10-2004-x64
1Qt6Network.dll
windows7-x64
1Qt6Network.dll
windows10-2004-x64
1Qt6PrintSupport.dll
windows7-x64
1Qt6PrintSupport.dll
windows10-2004-x64
1Qt6Qml.dll
windows7-x64
1Qt6Qml.dll
windows10-2004-x64
1Qt6QmlModels.dll
windows7-x64
1Qt6QmlModels.dll
windows10-2004-x64
1Qt6Svg.dll
windows7-x64
1Qt6Svg.dll
windows10-2004-x64
1Qt6Widgets.dll
windows7-x64
1Qt6Widgets.dll
windows10-2004-x64
1api-docs/_...a.html
windows7-x64
1api-docs/_...a.html
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 03:19
Behavioral task
behavioral1
Sample
Fix+License+Keygen/Fix+License/binaryninjacore.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Fix+License+Keygen/Fix+License/binaryninjacore.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Fix+License+Keygen/Keygen+Patch/KEYGEN.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Fix+License+Keygen/Keygen+Patch/KEYGEN.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Join Telegram for more.url
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
Join Telegram for more.url
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
binaryninja_personal_dev_win64.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
binaryninja_personal_dev_win64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Qt6Core.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Qt6Core.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Qt6Gui.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Qt6Gui.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Qt6Network.dll
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
Qt6Network.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Qt6PrintSupport.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Qt6PrintSupport.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Qt6Qml.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
Qt6Qml.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
Qt6QmlModels.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Qt6QmlModels.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
Qt6Svg.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Qt6Svg.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Qt6Widgets.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
Qt6Widgets.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
api-docs/_modules/binaryninja.html
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
api-docs/_modules/binaryninja.html
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
6e64e5d5f9498058a300b26b8741d9d5
-
SHA1
837ce28e5e02788da63a7f1d8f20207d2b0bf523
-
SHA256
8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
-
SHA512
f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
-
SSDEEP
96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2404 876 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2392 wrote to memory of 876 2392 rundll32.exe rundll32.exe PID 2392 wrote to memory of 876 2392 rundll32.exe rundll32.exe PID 2392 wrote to memory of 876 2392 rundll32.exe rundll32.exe PID 2392 wrote to memory of 876 2392 rundll32.exe rundll32.exe PID 2392 wrote to memory of 876 2392 rundll32.exe rundll32.exe PID 2392 wrote to memory of 876 2392 rundll32.exe rundll32.exe PID 2392 wrote to memory of 876 2392 rundll32.exe rundll32.exe PID 876 wrote to memory of 2404 876 rundll32.exe WerFault.exe PID 876 wrote to memory of 2404 876 rundll32.exe WerFault.exe PID 876 wrote to memory of 2404 876 rundll32.exe WerFault.exe PID 876 wrote to memory of 2404 876 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 2403⤵
- Program crash