Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7 -
submitted
01-07-2020 07:49
Static task
static1
Behavioral task
behavioral1
Sample
june30.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
june30.dll
-
Size
607KB
-
MD5
086e1c7401f82543d162ebaef816ef35
-
SHA1
25fbe1ef6ed713011a02cd6fc930105d4f612130
-
SHA256
b8cef342a47915615a35aab7333567db7c86570d4d3362470e19b6d0b3dab1af
-
SHA512
be9bd937ef926cab65ada2f4103642993ae1428fa6b9a83f9824cc4f10cb07354954fa948a5d9b2c83ac79f7ac04269d9fb3ac8f21e46c53fdb2b4dd39c726f7
Score
10/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 896 wrote to memory of 596 896 rundll32.exe 24 PID 896 wrote to memory of 596 896 rundll32.exe 24 PID 896 wrote to memory of 596 896 rundll32.exe 24 PID 896 wrote to memory of 596 896 rundll32.exe 24 PID 896 wrote to memory of 596 896 rundll32.exe 24 PID 896 wrote to memory of 596 896 rundll32.exe 24 PID 896 wrote to memory of 596 896 rundll32.exe 24 PID 596 wrote to memory of 1880 596 rundll32.exe 27 PID 596 wrote to memory of 1880 596 rundll32.exe 27 PID 596 wrote to memory of 1880 596 rundll32.exe 27 PID 596 wrote to memory of 1880 596 rundll32.exe 27 PID 596 wrote to memory of 1880 596 rundll32.exe 27 PID 596 wrote to memory of 1880 596 rundll32.exe 27 PID 596 wrote to memory of 1880 596 rundll32.exe 27 PID 596 wrote to memory of 1880 596 rundll32.exe 27 PID 596 wrote to memory of 1880 596 rundll32.exe 27 PID 1880 wrote to memory of 1608 1880 msiexec.exe 30 PID 1880 wrote to memory of 1608 1880 msiexec.exe 30 PID 1880 wrote to memory of 1608 1880 msiexec.exe 30 PID 1880 wrote to memory of 1608 1880 msiexec.exe 30 PID 1608 wrote to memory of 2012 1608 cmd.exe 32 PID 1608 wrote to memory of 2012 1608 cmd.exe 32 PID 1608 wrote to memory of 2012 1608 cmd.exe 32 PID 1608 wrote to memory of 2012 1608 cmd.exe 32 PID 1880 wrote to memory of 324 1880 msiexec.exe 33 PID 1880 wrote to memory of 324 1880 msiexec.exe 33 PID 1880 wrote to memory of 324 1880 msiexec.exe 33 PID 1880 wrote to memory of 324 1880 msiexec.exe 33 PID 324 wrote to memory of 2032 324 cmd.exe 35 PID 324 wrote to memory of 2032 324 cmd.exe 35 PID 324 wrote to memory of 2032 324 cmd.exe 35 PID 324 wrote to memory of 2032 324 cmd.exe 35 PID 2032 wrote to memory of 608 2032 net.exe 36 PID 2032 wrote to memory of 608 2032 net.exe 36 PID 2032 wrote to memory of 608 2032 net.exe 36 PID 2032 wrote to memory of 608 2032 net.exe 36 PID 1880 wrote to memory of 1452 1880 msiexec.exe 37 PID 1880 wrote to memory of 1452 1880 msiexec.exe 37 PID 1880 wrote to memory of 1452 1880 msiexec.exe 37 PID 1880 wrote to memory of 1452 1880 msiexec.exe 37 PID 1452 wrote to memory of 468 1452 cmd.exe 39 PID 1452 wrote to memory of 468 1452 cmd.exe 39 PID 1452 wrote to memory of 468 1452 cmd.exe 39 PID 1452 wrote to memory of 468 1452 cmd.exe 39 PID 1880 wrote to memory of 1356 1880 msiexec.exe 40 PID 1880 wrote to memory of 1356 1880 msiexec.exe 40 PID 1880 wrote to memory of 1356 1880 msiexec.exe 40 PID 1880 wrote to memory of 1356 1880 msiexec.exe 40 PID 1356 wrote to memory of 1476 1356 cmd.exe 42 PID 1356 wrote to memory of 1476 1356 cmd.exe 42 PID 1356 wrote to memory of 1476 1356 cmd.exe 42 PID 1356 wrote to memory of 1476 1356 cmd.exe 42 -
Blacklisted process makes network request 16 IoCs
flow pid Process 7 1880 msiexec.exe 8 1880 msiexec.exe 9 1880 msiexec.exe 10 1880 msiexec.exe 11 1880 msiexec.exe 12 1880 msiexec.exe 13 1880 msiexec.exe 14 1880 msiexec.exe 15 1880 msiexec.exe 16 1880 msiexec.exe 17 1880 msiexec.exe 18 1880 msiexec.exe 19 1880 msiexec.exe 20 1880 msiexec.exe 21 1880 msiexec.exe 22 1880 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1880 msiexec.exe -
Runs net.exe
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 468 net.exe 1476 net.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 596 set thread context of 1880 596 rundll32.exe 27 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 1880 msiexec.exe Token: SeSecurityPrivilege 1880 msiexec.exe -
Modifies service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas ipconfig.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs ipconfig.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\june30.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\june30.dll,#12⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:596 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /all4⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all5⤵
- Modifies service
PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net config workstation4⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\net.exenet config workstation5⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation6⤵PID:608
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all4⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\net.exenet view /all5⤵
- Discovers systems in the same network
PID:468
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all /domain4⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\net.exenet view /all /domain5⤵
- Discovers systems in the same network
PID:1476
-
-
-
-