c148ef2b7490fa7c5e4d346bf8c7ef97739b5b869938c5c9ba4b7d265966b9b7

General

Target

c148ef2b7490fa7c5e4d346bf8c7ef97739b5b869938c5c9ba4b7d265966b9b7.sample.dll
Size

348KB
MD5

545b25ce5c6c814af5cdef862909b7f7
SHA1

d8648d6a28f5b7dbb1890101ee210e3eb3945ccf
SHA256

c148ef2b7490fa7c5e4d346bf8c7ef97739b5b869938c5c9ba4b7d265966b9b7
SHA512

bfe8aab424e063ec23ce114e7cf73bcf0bb7aaa78ef0ab3a5b6438c363739d19512b4207f5b3dc3c922a1fac807872760ccce0cab5cadefce1d8d7b739246d1a

Score

8^/10

bootkit persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CD3E.tmp

pid process

1928 CD3E.tmp
Deletes itself 1 IoCs

Processes:

rundll32.exe

pid process

1068 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

rundll32.exe

pid process

1068 rundll32.exe
1068 rundll32.exe
1720
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe

pid	process
1928	CD3E.tmp

pid	process
1068	rundll32.exe

pid	process
1068	rundll32.exe
1068	rundll32.exe
1720

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Drops file in Program Files directory 64 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDREST.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OSPP.VBS	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\SERVWRAP.ASP	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPM.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDREQ.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.PPT	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\ACTIVITY.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Settings.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REC.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.XLS	rundll32.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POST.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESP.CFG	rundll32.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\eula.rtf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\MDIParent.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOC.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACT.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfigInternal.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Visualizer.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\EmptyDatabase.zip	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h	rundll32.exe
File opened for modification	C:\Program Files\SyncCopy.rar	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLPERF.H	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SHARING.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDCNCL.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip	rundll32.exe
File opened for modification	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSMMS.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\SettingsInternal.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEM.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESN.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGN.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEM.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RCLRPT.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\APPT.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\TextFile.zip	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMIMEE.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMIMES.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFNOT.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKREQ.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSSMS.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RESEND.CFG	rundll32.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exe

description	ioc	process
File created	C:\Windows\c148ef2b7490fa7c5e4d346bf8c7ef97739b5b869938c5c9ba4b7d265966b9b7.sample	rundll32.exe
File created	C:\Windows\dllhost.dat	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1756 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exeCD3E.tmp

pid process

1068 rundll32.exe
1928 CD3E.tmp
1928 CD3E.tmp
1928 CD3E.tmp
1928 CD3E.tmp
1928 CD3E.tmp

pid	process
1756	schtasks.exe

pid	process
1068	rundll32.exe
1928	CD3E.tmp
1928	CD3E.tmp
1928	CD3E.tmp
1928	CD3E.tmp
1928	CD3E.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

rundll32.exeCD3E.tmp

description	pid	process
Token: SeShutdownPrivilege	1068	rundll32.exe
Token: SeDebugPrivilege	1068	rundll32.exe
Token: SeTcbPrivilege	1068	rundll32.exe
Token: SeDebugPrivilege	1928	CD3E.tmp

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

rundll32.exerundll32.execmd.exe

description	pid	process	target process
PID 1940 wrote to memory of 1068	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1068	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1068	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1068	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1068	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1068	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1068	1940	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1956	1068	rundll32.exe	cmd.exe
PID 1068 wrote to memory of 1956	1068	rundll32.exe	cmd.exe
PID 1068 wrote to memory of 1956	1068	rundll32.exe	cmd.exe
PID 1068 wrote to memory of 1956	1068	rundll32.exe	cmd.exe
PID 1068 wrote to memory of 1928	1068	rundll32.exe	CD3E.tmp
PID 1068 wrote to memory of 1928	1068	rundll32.exe	CD3E.tmp
PID 1068 wrote to memory of 1928	1068	rundll32.exe	CD3E.tmp
PID 1068 wrote to memory of 1928	1068	rundll32.exe	CD3E.tmp
PID 1956 wrote to memory of 1756	1956	cmd.exe	schtasks.exe
PID 1956 wrote to memory of 1756	1956	cmd.exe	schtasks.exe
PID 1956 wrote to memory of 1756	1956	cmd.exe	schtasks.exe
PID 1956 wrote to memory of 1756	1956	cmd.exe	schtasks.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c148ef2b7490fa7c5e4d346bf8c7ef97739b5b869938c5c9ba4b7d265966b9b7.sample.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c148ef2b7490fa7c5e4d346bf8c7ef97739b5b869938c5c9ba4b7d265966b9b7.sample.dll,#1
2⤵
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 14:50
3⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 14:50
4⤵
- Creates scheduled task(s)
PID:1756

C:\Users\Admin\AppData\Local\Temp\CD3E.tmp
"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp" \\.\pipe\{1470F22A-2734-4ECB-96E2-B999194FAEDC}
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Bootkit

1

T1067

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CD3E.tmp
MD5
7e37ab34ecdcc3e77e24522ddfd4852d

SHA1
38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf

SHA256
02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f

SHA512
1b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587

Download Submit
\Users\Admin\AppData\Local\Temp\CD3E.tmp
MD5
7e37ab34ecdcc3e77e24522ddfd4852d

SHA1
38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf

SHA256
02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f

SHA512
1b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587

Download Submit
\Users\Admin\AppData\Local\Temp\CD3E.tmp
MD5
7e37ab34ecdcc3e77e24522ddfd4852d

SHA1
38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf

SHA256
02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f

SHA512
1b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587

Download Submit
\Users\Admin\AppData\Local\Temp\CD3E.tmp
MD5
7e37ab34ecdcc3e77e24522ddfd4852d

SHA1
38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf

SHA256
02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f

SHA512
1b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587

Download Submit
memory/1068-59-0x0000000000000000-mapping.dmp

Download
memory/1068-60-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1068-61-0x0000000000810000-0x000000000086E000-memory.dmp

Filesize
376KB

Download
memory/1068-66-0x0000000000810000-0x000000000086E000-memory.dmp

Filesize
376KB

Download
memory/1756-73-0x0000000000000000-mapping.dmp

Download
memory/1928-70-0x0000000000000000-mapping.dmp

Download
memory/1956-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads