b65776ee765163d76689852aa6e04a614663c762a2ffca103f5faa4cdb5759fd

Analysis

max time kernel
148s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
12/02/2021, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hpqhvsei.dll
Size 208KB
Sample210212-harqd4st4a
SHA256 b65776ee765163d76689852aa6e04a614663c762a2ffca103f5faa4cdb5759fd
MD5 e56ba27e301f0041109a7e2033a59599
SHA1 365f06e8babf593e3a1668771e8a101aadd104d1
SHA512 4f86e5a1c660d0a98af81859aa88e6163d9a63d943eff1d749b4f708f4178c1f2446b27c589e857e3721de6029eb5ee8261d9231dffd49edc7990e64ce1c5d35
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	4828	rundll32.exe
7	4828	rundll32.exe
9	4828	rundll32.exe
18	4828	rundll32.exe
19	4828	rundll32.exe
20	4828	rundll32.exe
21	4828	rundll32.exe
22	4828	rundll32.exe
23	4828	rundll32.exe
24	4828	rundll32.exe
25	4828	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4828	4812	rundll32.exe	38
PID 4812 wrote to memory of 4828	4812	rundll32.exe	38
PID 4812 wrote to memory of 4828	4812	rundll32.exe	38

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hpqhvsei.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hpqhvsei.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4828-3-0x0000000010000000-0x000000001000D000-memory.dmp

Download