Resubmissions
24-01-2024 08:17
240124-j6t41adgg8 1024-01-2024 07:52
240124-jqd3vadcfj 1023-01-2024 11:54
240123-n28ttaafc8 1024-06-2020 13:13
200624-qjwbdtfea2 10Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
24-06-2020 13:13
Static task
static1
Behavioral task
behavioral1
Sample
june23.dll
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
-
Target
june23.dll
-
Size
383KB
-
MD5
7e889962ed9651933c46faa6f7b5ab6d
-
SHA1
015639fe2a6af8d9205e0fb36226c9d134b49fd8
-
SHA256
a51d5fe8c5f9ea9c4af866b7b6669845433934e4b4528995a3ac1702e7002c0e
-
SHA512
914e07996a14bd4499b91333ab0de65748e5617d543dd0eff3a269d24a542f15cbe1dca7be618843c0d7fb60dcaf96e20e5de95ac2989dc48850ab1a10aa8ff2
Score
10/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 1756 msiexec.exe Token: SeSecurityPrivilege 1756 msiexec.exe -
Blacklisted process makes network request 11 IoCs
flow pid Process 6 1756 msiexec.exe 7 1756 msiexec.exe 8 1756 msiexec.exe 9 1756 msiexec.exe 10 1756 msiexec.exe 11 1756 msiexec.exe 12 1756 msiexec.exe 13 1756 msiexec.exe 14 1756 msiexec.exe 15 1756 msiexec.exe 16 1756 msiexec.exe -
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 308 net.exe 984 net.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 788 set thread context of 1756 788 rundll32.exe 29 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1756 msiexec.exe -
Modifies service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas ipconfig.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs ipconfig.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1532 wrote to memory of 788 1532 rundll32.exe 24 PID 1532 wrote to memory of 788 1532 rundll32.exe 24 PID 1532 wrote to memory of 788 1532 rundll32.exe 24 PID 1532 wrote to memory of 788 1532 rundll32.exe 24 PID 1532 wrote to memory of 788 1532 rundll32.exe 24 PID 1532 wrote to memory of 788 1532 rundll32.exe 24 PID 1532 wrote to memory of 788 1532 rundll32.exe 24 PID 788 wrote to memory of 1756 788 rundll32.exe 29 PID 788 wrote to memory of 1756 788 rundll32.exe 29 PID 788 wrote to memory of 1756 788 rundll32.exe 29 PID 788 wrote to memory of 1756 788 rundll32.exe 29 PID 788 wrote to memory of 1756 788 rundll32.exe 29 PID 788 wrote to memory of 1756 788 rundll32.exe 29 PID 788 wrote to memory of 1756 788 rundll32.exe 29 PID 788 wrote to memory of 1756 788 rundll32.exe 29 PID 788 wrote to memory of 1756 788 rundll32.exe 29 PID 1756 wrote to memory of 1972 1756 msiexec.exe 32 PID 1756 wrote to memory of 1972 1756 msiexec.exe 32 PID 1756 wrote to memory of 1972 1756 msiexec.exe 32 PID 1756 wrote to memory of 1972 1756 msiexec.exe 32 PID 1972 wrote to memory of 1980 1972 cmd.exe 34 PID 1972 wrote to memory of 1980 1972 cmd.exe 34 PID 1972 wrote to memory of 1980 1972 cmd.exe 34 PID 1972 wrote to memory of 1980 1972 cmd.exe 34 PID 1756 wrote to memory of 1056 1756 msiexec.exe 35 PID 1756 wrote to memory of 1056 1756 msiexec.exe 35 PID 1756 wrote to memory of 1056 1756 msiexec.exe 35 PID 1756 wrote to memory of 1056 1756 msiexec.exe 35 PID 1056 wrote to memory of 1304 1056 cmd.exe 37 PID 1056 wrote to memory of 1304 1056 cmd.exe 37 PID 1056 wrote to memory of 1304 1056 cmd.exe 37 PID 1056 wrote to memory of 1304 1056 cmd.exe 37 PID 1304 wrote to memory of 848 1304 net.exe 38 PID 1304 wrote to memory of 848 1304 net.exe 38 PID 1304 wrote to memory of 848 1304 net.exe 38 PID 1304 wrote to memory of 848 1304 net.exe 38 PID 1756 wrote to memory of 108 1756 msiexec.exe 39 PID 1756 wrote to memory of 108 1756 msiexec.exe 39 PID 1756 wrote to memory of 108 1756 msiexec.exe 39 PID 1756 wrote to memory of 108 1756 msiexec.exe 39 PID 108 wrote to memory of 308 108 cmd.exe 41 PID 108 wrote to memory of 308 108 cmd.exe 41 PID 108 wrote to memory of 308 108 cmd.exe 41 PID 108 wrote to memory of 308 108 cmd.exe 41 PID 1756 wrote to memory of 644 1756 msiexec.exe 42 PID 1756 wrote to memory of 644 1756 msiexec.exe 42 PID 1756 wrote to memory of 644 1756 msiexec.exe 42 PID 1756 wrote to memory of 644 1756 msiexec.exe 42 PID 644 wrote to memory of 984 644 cmd.exe 44 PID 644 wrote to memory of 984 644 cmd.exe 44 PID 644 wrote to memory of 984 644 cmd.exe 44 PID 644 wrote to memory of 984 644 cmd.exe 44
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\june23.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\june23.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /all4⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all5⤵
- Modifies service
PID:1980
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net config workstation4⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\net.exenet config workstation5⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation6⤵PID:848
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all4⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\net.exenet view /all5⤵
- Discovers systems in the same network
PID:308
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all /domain4⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\net.exenet view /all /domain5⤵
- Discovers systems in the same network
PID:984
-
-
-
-