Analysis
-
max time kernel
47s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 12:51
Static task
static1
Behavioral task
behavioral1
Sample
44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
-
Size
1.7MB
-
MD5
faaafa3e115033ba5115ed6a6ba59ba9
-
SHA1
ca16a95cd38707bad2dc524bb3086b3c0cb3e372
-
SHA256
44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316
-
SHA512
6f2fe02c1e15be2409f89ff1e6ae3c78f87e242ee448fe5ff6d375a74f10c7c6cc01f3f6d796aa34599a891e03c5d421d10f0c041e5a6dc0e346aea3ae21a935
Score
1/10
Malware Config
Signatures
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2172 ipconfig.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 912 rundll32.exe Token: SeDebugPrivilege 912 rundll32.exe Token: SeDebugPrivilege 912 rundll32.exe Token: SeDebugPrivilege 912 rundll32.exe Token: SeDebugPrivilege 912 rundll32.exe Token: SeDebugPrivilege 912 rundll32.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 912 wrote to memory of 1772 912 rundll32.exe 71 PID 912 wrote to memory of 1772 912 rundll32.exe 71 PID 912 wrote to memory of 1892 912 rundll32.exe 74 PID 912 wrote to memory of 1892 912 rundll32.exe 74 PID 912 wrote to memory of 3180 912 rundll32.exe 76 PID 912 wrote to memory of 3180 912 rundll32.exe 76 PID 3180 wrote to memory of 2172 3180 cmd.exe 80 PID 3180 wrote to memory of 2172 3180 cmd.exe 80 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2684 912 rundll32.exe 82 PID 912 wrote to memory of 2684 912 rundll32.exe 82 PID 912 wrote to memory of 2684 912 rundll32.exe 82 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 2660 912 rundll32.exe 81 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1788 912 rundll32.exe 88 PID 912 wrote to memory of 1788 912 rundll32.exe 88 PID 912 wrote to memory of 1788 912 rundll32.exe 88 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 1784 912 rundll32.exe 87 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3788 912 rundll32.exe 90 PID 912 wrote to memory of 3788 912 rundll32.exe 90 PID 912 wrote to memory of 3788 912 rundll32.exe 90 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89 PID 912 wrote to memory of 3216 912 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll,#11⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\System32\cmd.exe/c "dir"2⤵PID:1772
-
-
C:\Windows\System32\cmd.exe/c "set"2⤵PID:1892
-
-
C:\Windows\System32\cmd.exe/c "ipconfig /all"2⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2172
-
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:2660
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:2684
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1784
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1788
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:3216
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:3788
-