10c80e10ccce71780d02f8886929530d8fe7faff7dd368f646fcbc72d4009159

Analysis

Target
temp.tmp.dll
Size 130KB
Sample200827-remza9l6a2
SHA256 10c80e10ccce71780d02f8886929530d8fe7faff7dd368f646fcbc72d4009159
MD5 614372725ec00da4c770ded3f372a5ba
SHA1 3611ec99ad899d31306b92ff7eae60835663bbcc
SHA512 261f1de9e877580bbb40c78463e15234a9163d44f5a9b43e7d6731e90f41b21844c4a43a2e306d3b029f726e219f3cd0051988a0a3fc34851e2c749826d9e439
MD5 SHA1 SHA512

Score

9^/10

ServiceHost packer 3 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/580-2-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/580-3-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/580-4-0x0000000000000000-mapping.dmp	servicehost

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3856	580	WerFault.exe	67

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 4e566568c77cd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3672	svchost.exe
Token: SeCreatePagefilePrivilege	3672	svchost.exe
Token: SeRestorePrivilege	3856	WerFault.exe
Token: SeBackupPrivilege	3856	WerFault.exe
Token: SeDebugPrivilege	3856	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 580	3940	rundll32.exe	67
PID 3940 wrote to memory of 580	3940	rundll32.exe	67
PID 3940 wrote to memory of 580	3940	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
  2⤵
  PID:580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 640
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3856

memory/3856-1-0x00000000046F0000-0x00000000046F1000-memory.dmp

Download

memory/3856-5-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download