Resubmissions

07-01-2024 01:26

240107-btjthabgdj 10

08-11-2020 14:30

201108-mlp13srey6 8

Analysis

  • max time kernel
    4s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    08-11-2020 14:30

General

  • Target

    24ff7026fc4c06e06f7188c44a5e2d4429aab0d0de9fcd93d4f8e95210be7ba6.dll

  • Size

    1.6MB

  • MD5

    11ebdce88a124b803dbae051ec56e8d3

  • SHA1

    7616165d2eddc7b6a89fc900ed5dbf5713f87351

  • SHA256

    24ff7026fc4c06e06f7188c44a5e2d4429aab0d0de9fcd93d4f8e95210be7ba6

  • SHA512

    647198bcfcbcf53062c69d88f403fb2c6ac15df9ee753c3fa7cf4cffee068e230399ab404c3092145354d7573ba496aff9bacf80457de5bfa71df4e070ab0f8b

Score
8/10

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies service 2 TTPs 11 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\24ff7026fc4c06e06f7188c44a5e2d4429aab0d0de9fcd93d4f8e95210be7ba6.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\24ff7026fc4c06e06f7188c44a5e2d4429aab0d0de9fcd93d4f8e95210be7ba6.dll,#1
      2⤵
      • Checks BIOS information in registry
      • Modifies service
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:1944
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k LocalService
    1⤵
      PID:1912

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1944-0-0x0000000000000000-mapping.dmp