Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
15/07/2020, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
512.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
512.dll
-
Size
367KB
-
MD5
56921bed6e4dd3ba4064557d453e403e
-
SHA1
9a2ec0abbde02b61d56990882ea6c43d833114b3
-
SHA256
a1ea6e27f13d729c388d0cf8a22f07407bf52290d0b68f4d4da1637d3a2b8eea
-
SHA512
d27da6d2386185d1ea76a195bee2d72e1ac229b841f4b60eafe0e4055cbaaaeecd99e1d9f0693eab660fa480baa74a00ad9a0ca43b392a83d285ddea4bf8911c
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3908 wrote to memory of 1164 3908 rundll32.exe 68 PID 3908 wrote to memory of 1164 3908 rundll32.exe 68 PID 3908 wrote to memory of 1164 3908 rundll32.exe 68 PID 1164 wrote to memory of 2552 1164 rundll32.exe 73 PID 1164 wrote to memory of 2552 1164 rundll32.exe 73 PID 1164 wrote to memory of 2552 1164 rundll32.exe 73 PID 1164 wrote to memory of 2552 1164 rundll32.exe 73 PID 1164 wrote to memory of 2552 1164 rundll32.exe 73 PID 2552 wrote to memory of 2864 2552 svchost.exe 74 PID 2552 wrote to memory of 2864 2552 svchost.exe 74 PID 2552 wrote to memory of 2864 2552 svchost.exe 74 PID 2552 wrote to memory of 3824 2552 svchost.exe 76 PID 2552 wrote to memory of 3824 2552 svchost.exe 76 PID 2552 wrote to memory of 3824 2552 svchost.exe 76 PID 2552 wrote to memory of 3824 2552 svchost.exe 76 PID 2552 wrote to memory of 3824 2552 svchost.exe 76 -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 2552 svchost.exe 2552 svchost.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4064 1164 WerFault.exe 68 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1164 set thread context of 2552 1164 rundll32.exe 73 PID 2552 set thread context of 3824 2552 svchost.exe 76 -
Suspicious use of AdjustPrivilegeToken 67 IoCs
description pid Process Token: SeImpersonatePrivilege 2552 svchost.exe Token: SeTcbPrivilege 2552 svchost.exe Token: SeChangeNotifyPrivilege 2552 svchost.exe Token: SeCreateTokenPrivilege 2552 svchost.exe Token: SeBackupPrivilege 2552 svchost.exe Token: SeRestorePrivilege 2552 svchost.exe Token: SeIncreaseQuotaPrivilege 2552 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2552 svchost.exe Token: SeImpersonatePrivilege 2552 svchost.exe Token: SeTcbPrivilege 2552 svchost.exe Token: SeChangeNotifyPrivilege 2552 svchost.exe Token: SeCreateTokenPrivilege 2552 svchost.exe Token: SeBackupPrivilege 2552 svchost.exe Token: SeRestorePrivilege 2552 svchost.exe Token: SeIncreaseQuotaPrivilege 2552 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2552 svchost.exe Token: SeImpersonatePrivilege 2552 svchost.exe Token: SeTcbPrivilege 2552 svchost.exe Token: SeChangeNotifyPrivilege 2552 svchost.exe Token: SeCreateTokenPrivilege 2552 svchost.exe Token: SeBackupPrivilege 2552 svchost.exe Token: SeRestorePrivilege 2552 svchost.exe Token: SeIncreaseQuotaPrivilege 2552 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2552 svchost.exe Token: SeImpersonatePrivilege 2552 svchost.exe Token: SeTcbPrivilege 2552 svchost.exe Token: SeChangeNotifyPrivilege 2552 svchost.exe Token: SeCreateTokenPrivilege 2552 svchost.exe Token: SeBackupPrivilege 2552 svchost.exe Token: SeRestorePrivilege 2552 svchost.exe Token: SeIncreaseQuotaPrivilege 2552 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2552 svchost.exe Token: SeImpersonatePrivilege 2552 svchost.exe Token: SeTcbPrivilege 2552 svchost.exe Token: SeChangeNotifyPrivilege 2552 svchost.exe Token: SeCreateTokenPrivilege 2552 svchost.exe Token: SeBackupPrivilege 2552 svchost.exe Token: SeRestorePrivilege 2552 svchost.exe Token: SeIncreaseQuotaPrivilege 2552 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2552 svchost.exe Token: SeImpersonatePrivilege 3824 svchost.exe Token: SeTcbPrivilege 3824 svchost.exe Token: SeChangeNotifyPrivilege 3824 svchost.exe Token: SeCreateTokenPrivilege 3824 svchost.exe Token: SeBackupPrivilege 3824 svchost.exe Token: SeRestorePrivilege 3824 svchost.exe Token: SeIncreaseQuotaPrivilege 3824 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3824 svchost.exe Token: SeImpersonatePrivilege 3824 svchost.exe Token: SeTcbPrivilege 3824 svchost.exe Token: SeChangeNotifyPrivilege 3824 svchost.exe Token: SeCreateTokenPrivilege 3824 svchost.exe Token: SeBackupPrivilege 3824 svchost.exe Token: SeRestorePrivilege 3824 svchost.exe Token: SeIncreaseQuotaPrivilege 3824 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3824 svchost.exe Token: SeImpersonatePrivilege 3824 svchost.exe Token: SeTcbPrivilege 3824 svchost.exe Token: SeChangeNotifyPrivilege 3824 svchost.exe Token: SeCreateTokenPrivilege 3824 svchost.exe Token: SeBackupPrivilege 3824 svchost.exe Token: SeRestorePrivilege 3824 svchost.exe Token: SeIncreaseQuotaPrivilege 3824 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3824 svchost.exe Token: SeRestorePrivilege 4064 WerFault.exe Token: SeBackupPrivilege 4064 WerFault.exe Token: SeDebugPrivilege 4064 WerFault.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\512.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\512.dll,#12⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1164 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd /K4⤵PID:2864
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3824
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 6563⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:4064
-
-