Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows7_x64 -
resource
win7 -
submitted
15/07/2020, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
512.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
512.dll
-
Size
367KB
-
MD5
56921bed6e4dd3ba4064557d453e403e
-
SHA1
9a2ec0abbde02b61d56990882ea6c43d833114b3
-
SHA256
a1ea6e27f13d729c388d0cf8a22f07407bf52290d0b68f4d4da1637d3a2b8eea
-
SHA512
d27da6d2386185d1ea76a195bee2d72e1ac229b841f4b60eafe0e4055cbaaaeecd99e1d9f0693eab660fa480baa74a00ad9a0ca43b392a83d285ddea4bf8911c
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1496 wrote to memory of 1560 1496 rundll32.exe 24 PID 1496 wrote to memory of 1560 1496 rundll32.exe 24 PID 1496 wrote to memory of 1560 1496 rundll32.exe 24 PID 1496 wrote to memory of 1560 1496 rundll32.exe 24 PID 1496 wrote to memory of 1560 1496 rundll32.exe 24 PID 1496 wrote to memory of 1560 1496 rundll32.exe 24 PID 1496 wrote to memory of 1560 1496 rundll32.exe 24 PID 1560 wrote to memory of 108 1560 rundll32.exe 25 PID 1560 wrote to memory of 108 1560 rundll32.exe 25 PID 1560 wrote to memory of 108 1560 rundll32.exe 25 PID 1560 wrote to memory of 108 1560 rundll32.exe 25 PID 1560 wrote to memory of 108 1560 rundll32.exe 25 PID 1560 wrote to memory of 108 1560 rundll32.exe 25 PID 108 wrote to memory of 1836 108 svchost.exe 28 PID 108 wrote to memory of 1836 108 svchost.exe 28 PID 108 wrote to memory of 1836 108 svchost.exe 28 PID 108 wrote to memory of 1836 108 svchost.exe 28 PID 108 wrote to memory of 1888 108 svchost.exe 30 PID 108 wrote to memory of 1888 108 svchost.exe 30 PID 108 wrote to memory of 1888 108 svchost.exe 30 PID 108 wrote to memory of 1888 108 svchost.exe 30 PID 108 wrote to memory of 1888 108 svchost.exe 30 PID 108 wrote to memory of 1888 108 svchost.exe 30 -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1560 set thread context of 108 1560 rundll32.exe 25 PID 108 set thread context of 1888 108 svchost.exe 30 -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 108 svchost.exe Token: SeTcbPrivilege 108 svchost.exe Token: SeChangeNotifyPrivilege 108 svchost.exe Token: SeCreateTokenPrivilege 108 svchost.exe Token: SeBackupPrivilege 108 svchost.exe Token: SeRestorePrivilege 108 svchost.exe Token: SeIncreaseQuotaPrivilege 108 svchost.exe Token: SeAssignPrimaryTokenPrivilege 108 svchost.exe Token: SeImpersonatePrivilege 108 svchost.exe Token: SeTcbPrivilege 108 svchost.exe Token: SeChangeNotifyPrivilege 108 svchost.exe Token: SeCreateTokenPrivilege 108 svchost.exe Token: SeBackupPrivilege 108 svchost.exe Token: SeRestorePrivilege 108 svchost.exe Token: SeIncreaseQuotaPrivilege 108 svchost.exe Token: SeAssignPrimaryTokenPrivilege 108 svchost.exe Token: SeImpersonatePrivilege 108 svchost.exe Token: SeTcbPrivilege 108 svchost.exe Token: SeChangeNotifyPrivilege 108 svchost.exe Token: SeCreateTokenPrivilege 108 svchost.exe Token: SeBackupPrivilege 108 svchost.exe Token: SeRestorePrivilege 108 svchost.exe Token: SeIncreaseQuotaPrivilege 108 svchost.exe Token: SeAssignPrimaryTokenPrivilege 108 svchost.exe Token: SeImpersonatePrivilege 108 svchost.exe Token: SeTcbPrivilege 108 svchost.exe Token: SeChangeNotifyPrivilege 108 svchost.exe Token: SeCreateTokenPrivilege 108 svchost.exe Token: SeBackupPrivilege 108 svchost.exe Token: SeRestorePrivilege 108 svchost.exe Token: SeIncreaseQuotaPrivilege 108 svchost.exe Token: SeAssignPrimaryTokenPrivilege 108 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 108 svchost.exe 108 svchost.exe 108 svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 svchost.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\512.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\512.dll,#12⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1560 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Modifies system certificate store
PID:108 -
C:\Windows\SysWOW64\cmd.execmd /K4⤵PID:1836
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵PID:1888
-
-
-