Overview
overview
10Static
static
804443c70d3...be.exe
windows7_x64
904443c70d3...be.exe
windows10_x64
905535d72f3...06.exe
windows7_x64
105535d72f3...06.exe
windows10_x64
11bec139d54...72.exe
windows7_x64
81bec139d54...72.exe
windows10_x64
81f670ff8cc...55.exe
windows7_x64
11f670ff8cc...55.exe
windows10_x64
12deaa0ec74...ea.exe
windows7_x64
102deaa0ec74...ea.exe
windows10_x64
10372b929ae9...ef.dll
windows7_x64
9372b929ae9...ef.dll
windows10_x64
938ee6bea62...15.exe
windows7_x64
338ee6bea62...15.exe
windows10_x64
3437d91ce52...8f.exe
windows7_x64
1437d91ce52...8f.exe
windows10_x64
4447058c1c6...a8.exe
windows7_x64
9447058c1c6...a8.exe
windows10_x64
95061c0b08d...03.exe
windows7_x64
15061c0b08d...03.exe
windows10_x64
15ed4b682ef...d4.exe
windows7_x64
85ed4b682ef...d4.exe
windows10_x64
86970600d21...b5.exe
windows7_x64
16970600d21...b5.exe
windows10_x64
172f528f9a6...92.exe
windows7_x64
872f528f9a6...92.exe
windows10_x64
873dcee7abe...99.exe
windows7_x64
173dcee7abe...99.exe
windows10_x64
17e118b534a...d2.exe
windows7_x64
107e118b534a...d2.exe
windows10_x64
108034fffb03...3c.exe
windows7_x64
108034fffb03...3c.exe
windows10_x64
10Analysis
-
max time kernel
151s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-03-2021 09:49
Static task
static1
Behavioral task
behavioral1
Sample
04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
05535d72f3f98c73d9b660625e1b627b1bebbd15d7d4add4ecc492a2b0d67a06.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral4
Sample
05535d72f3f98c73d9b660625e1b627b1bebbd15d7d4add4ecc492a2b0d67a06.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
1bec139d54d147196c4e736d8dcf1f39d2bff390d59d5b240b4a97e03763cf72.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral6
Sample
1bec139d54d147196c4e736d8dcf1f39d2bff390d59d5b240b4a97e03763cf72.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
1f670ff8cca59a61aa0d58f297788916a6a9a318c1e7a3319367b6ffdc45c755.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral8
Sample
1f670ff8cca59a61aa0d58f297788916a6a9a318c1e7a3319367b6ffdc45c755.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral10
Sample
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral12
Sample
372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral14
Sample
38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral16
Sample
437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
447058c1c6551c352895be7569e33c96384da3757303fc97004be45f56b4e9a8.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral18
Sample
447058c1c6551c352895be7569e33c96384da3757303fc97004be45f56b4e9a8.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
5061c0b08d522fdae45fc9285ac45fb96a4e80bd859867a0e988dfaeb2b33b03.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral20
Sample
5061c0b08d522fdae45fc9285ac45fb96a4e80bd859867a0e988dfaeb2b33b03.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral22
Sample
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
6970600d21285371d6a4fd6175b65b672b9b9aaea36353e1544f0672944c9fb5.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral24
Sample
6970600d21285371d6a4fd6175b65b672b9b9aaea36353e1544f0672944c9fb5.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral26
Sample
72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
73dcee7abeca24a9170f800d069e80283b9ea1bd7cc6fbabdf55c613897f9699.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral28
Sample
73dcee7abeca24a9170f800d069e80283b9ea1bd7cc6fbabdf55c613897f9699.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral30
Sample
7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
8034fffb03faec5aa94d3c16cdb98dfbcce06e8f8f7a278f7c30cff0398ea03c.exe
Resource
win7v20201028
windows7_x64
General
-
Target
372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll
-
Size
846KB
-
MD5
85003057fbddd3468478adc04a1b50cd
-
SHA1
acdd39a0d8068bfc4a16a0193c90eae85a5831fa
-
SHA256
372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef
-
SHA512
989f0738855e83b3ec9d97a7c9f93c0362285393cb1b7a266d6d1287bffad97c3a674c1738d1d0dc32c9751f68025da34f176a9bcc81c27b39fc1accdbbabb06
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule behavioral12/files/0x0005000000015253-3.dat acprotect -
Blocklisted process makes network request 5 IoCs
Processes:
rundll32.exeflow pid Process 15 4744 rundll32.exe 19 4744 rundll32.exe 21 4744 rundll32.exe 24 4744 rundll32.exe 25 4744 rundll32.exe -
Drops file in Drivers directory 1 IoCs
Processes:
rundll32.exedescription ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundll32.exe -
Sets service image path in registry 2 TTPs
-
Processes:
resource yara_rule behavioral12/files/0x0005000000015253-3.dat upx -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid Process 4744 rundll32.exe 4744 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc Process File created C:\Windows\syswow64\as5Gvk8TcV.sys rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
rundll32.exedescription ioc Process File created C:\Windows\MhkCahcvWf0.sys rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
rundll32.exedescription ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TypedURLs rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "https://www.hao123.com/?tn=92867579_hao_pg" rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} rundll32.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.hao123.com/?tn=92867579_hao_pg" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid Process 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe 4744 rundll32.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
rundll32.exepid Process 4744 rundll32.exe 624 -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
rundll32.exedescription pid Process Token: SeDebugPrivilege 4744 rundll32.exe Token: SeLoadDriverPrivilege 4744 rundll32.exe Token: SeLoadDriverPrivilege 4744 rundll32.exe Token: 33 4744 rundll32.exe Token: SeIncBasePriorityPrivilege 4744 rundll32.exe Token: 33 4744 rundll32.exe Token: SeIncBasePriorityPrivilege 4744 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
rundll32.exepid Process 4744 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
rundll32.exepid Process 4744 rundll32.exe 4744 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exedescription pid Process procid_target PID 4708 wrote to memory of 4744 4708 rundll32.exe 52 PID 4708 wrote to memory of 4744 4708 rundll32.exe 52 PID 4708 wrote to memory of 4744 4708 rundll32.exe 52 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22 PID 4744 wrote to memory of 2896 4744 rundll32.exe 22
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2896
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll,#13⤵
- Blocklisted process makes network request
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c637559fada3fe53e5a6f8dcc0a5bf4f
SHA1265af8613fef8024190e6e49b1b24cf34060d86b
SHA2569d7fc881646ba2db7023ed8f0857c1a82df0d81ebef839d20063a027fe4b9e7d
SHA512fc0a32bb05b3b4ff96382d0c3d1857b1eb70c4e9030073c33579998f1fca40c8dcd6b2960c329c9845af5aa245566577198fa18e9c1985850038e84af1ac56ce
-
MD5
2d97d64720ba391542418c755d3e98e6
SHA15fcc2a28d4676ba65231321f16b3cc222b9bfd99
SHA25629533c9c074b9c54ecc6cefa332ef481c6c2e14c52ea5054379474347e23a3f3
SHA512278e49c05b88f218fa9d0a60c5a66e2b1583044a5b3e3d3fb7a9f9b4892fe2802d107dc001420e9c3a00c98b957ed70a648a802392bb2ee296d6ef2072b7bce0