6679da77917ddc1ab75c7f05dee0701d172ff0bfc6a7cd92d4c73a66c877a7d8

General

Target

B3.dll
Size

567KB
MD5

06758591f9fede42c56ee311988acc4a
SHA1

d1ed2bd42658512faaacbe8d8230d3b542991654
SHA256

6679da77917ddc1ab75c7f05dee0701d172ff0bfc6a7cd92d4c73a66c877a7d8
SHA512

965c4ee025b0a146f4d7f332dc0768fb509389b9317581d97b6b94d003d60cfa9b3afe0dd973962eb5365b325f8a5e4b36482ba90b9dacfe4dfb1a864c05bb85

Score

9^/10

Malware Config

Signatures

ServiceHost packer 2 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/636-2-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/636-3-0x0000000000000000-mapping.dmp	servicehost

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3848 636 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

pid	pid_target	process	target process
3848	636	WerFault.exe	rundll32.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = ab1bb025f584d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

svchost.exeWerFault.exe

description	pid	process
Token: SeShutdownPrivilege	3972	svchost.exe
Token: SeCreatePagefilePrivilege	3972	svchost.exe
Token: SeRestorePrivilege	3848	WerFault.exe
Token: SeBackupPrivilege	3848	WerFault.exe
Token: SeDebugPrivilege	3848	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3908 wrote to memory of 636	3908	rundll32.exe	rundll32.exe
PID 3908 wrote to memory of 636	3908	rundll32.exe	rundll32.exe
PID 3908 wrote to memory of 636	3908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\B3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\B3.dll,#1
2⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 604
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-0-0x0000000000000000-mapping.dmp

Download
memory/636-2-0x0000000000000000-mapping.dmp

Download
memory/636-3-0x0000000000000000-mapping.dmp

Download
memory/3848-1-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/3848-4-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads