44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316

Analysis

max time kernel
47s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
Size 1.7MB
Sample201109-ev641tyqrx
SHA256 44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316
MD5 faaafa3e115033ba5115ed6a6ba59ba9
SHA1 ca16a95cd38707bad2dc524bb3086b3c0cb3e372
SHA512 6f2fe02c1e15be2409f89ff1e6ae3c78f87e242ee448fe5ff6d375a74f10c7c6cc01f3f6d796aa34599a891e03c5d421d10f0c041e5a6dc0e346aea3ae21a935
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
2172	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	rundll32.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	rundll32.exe
Token: SeDebugPrivilege	912	rundll32.exe
Token: SeDebugPrivilege	912	rundll32.exe
Token: SeDebugPrivilege	912	rundll32.exe
Token: SeDebugPrivilege	912	rundll32.exe
Token: SeDebugPrivilege	912	rundll32.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1772	912	rundll32.exe	71
PID 912 wrote to memory of 1772	912	rundll32.exe	71
PID 912 wrote to memory of 1892	912	rundll32.exe	74
PID 912 wrote to memory of 1892	912	rundll32.exe	74
PID 912 wrote to memory of 3180	912	rundll32.exe	76
PID 912 wrote to memory of 3180	912	rundll32.exe	76
PID 3180 wrote to memory of 2172	3180	cmd.exe	80
PID 3180 wrote to memory of 2172	3180	cmd.exe	80
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2684	912	rundll32.exe	82
PID 912 wrote to memory of 2684	912	rundll32.exe	82
PID 912 wrote to memory of 2684	912	rundll32.exe	82
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 2660	912	rundll32.exe	81
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1788	912	rundll32.exe	88
PID 912 wrote to memory of 1788	912	rundll32.exe	88
PID 912 wrote to memory of 1788	912	rundll32.exe	88
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 1784	912	rundll32.exe	87
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3788	912	rundll32.exe	90
PID 912 wrote to memory of 3788	912	rundll32.exe	90
PID 912 wrote to memory of 3788	912	rundll32.exe	90
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89
PID 912 wrote to memory of 3216	912	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll,#1
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\System32\cmd.exe
  /c "dir"
  2⤵
  PID:1772
- C:\Windows\System32\cmd.exe
  /c "set"
  2⤵
  PID:1892
- C:\Windows\System32\cmd.exe
  /c "ipconfig /all"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2172
- \??\c:\program files\internet explorer\iexplore.exe
  "c:\program files\internet explorer\iexplore.exe"
  2⤵
  PID:2660
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2684
- \??\c:\program files\internet explorer\iexplore.exe
  "c:\program files\internet explorer\iexplore.exe"
  2⤵
  PID:1784
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1788
- \??\c:\program files\internet explorer\iexplore.exe
  "c:\program files\internet explorer\iexplore.exe"
  2⤵
  PID:3216
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-16-0x000001E4C43A0000-0x000001E4C43A1000-memory.dmp

Download

memory/1784-22-0x000001E4C4270000-0x000001E4C4270011-memory.dmp

Download

memory/1784-19-0x000001E4C43A0000-0x000001E4C43A003F-memory.dmp

Download

memory/1784-18-0x000001E4C43A0000-0x000001E4C43A1000-memory.dmp

Download

memory/1784-17-0x000001E4C43A0000-0x000001E4C43A0035-memory.dmp

Download

memory/2660-6-0x0000017BE7BB0000-0x0000017BE7BB1000-memory.dmp

Download

memory/2660-12-0x0000017BE61E0000-0x0000017BE61E0011-memory.dmp

Download

memory/2660-11-0x0000017BE61C0000-0x0000017BE61D2000-memory.dmp

Download

memory/2660-9-0x0000017BE7BB0000-0x0000017BE7BB003F-memory.dmp

Download

memory/2660-8-0x0000017BE7BB0000-0x0000017BE7BB1000-memory.dmp

Download

memory/2660-7-0x0000017BE7BB0000-0x0000017BE7BB0035-memory.dmp

Download

memory/2684-4-0x0000024DF0600000-0x0000024DF0601000-memory.dmp

Download

memory/3216-26-0x0000016A66DD0000-0x0000016A66DD1000-memory.dmp

Download

memory/3216-27-0x0000016A66DD0000-0x0000016A66DD0035-memory.dmp

Download

memory/3216-28-0x0000016A66DD0000-0x0000016A66DD1000-memory.dmp

Download

memory/3216-29-0x0000016A66DD0000-0x0000016A66DD003F-memory.dmp

Download

memory/3216-32-0x0000016A65400000-0x0000016A65400011-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads