4db103f3bef49c43c766bc563068be45d617e7dd47d338fe592810c2bf04bc2f

General

Target

4db103f3bef49c43c766bc563068be45d617e7dd47d338fe592810c2bf04bc2f.sample.dll
Size

80KB
MD5

340d2d405126ba3e5edc8337a6ddb5b5
SHA1

c83f4535ce3c47fa2edf3d94e2e5b153f757b8f4
SHA256

4db103f3bef49c43c766bc563068be45d617e7dd47d338fe592810c2bf04bc2f
SHA512

180aa77d588bca616ac3a2db235e692006b93b7390948ee18c0aa59a6b1cea9f41f641a84a55df77a5da5788b6df7e9752fb17a242169b0961f8a9799c0f60f6

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\eeoacwbkuft = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\tdnwme.exe\""	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1968 1836 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1968	1836	WerFault.exe	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exeWerFault.exe

pid process

1836 rundll32.exe
1968 WerFault.exe
1968 WerFault.exe
1968 WerFault.exe
1968 WerFault.exe
1968 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1968 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1968 WerFault.exe

pid	process
1836	rundll32.exe
1968	WerFault.exe
1968	WerFault.exe
1968	WerFault.exe
1968	WerFault.exe
1968	WerFault.exe

pid	process
1968	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1968	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 792 wrote to memory of 1836	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1836	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1836	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1836	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1836	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1836	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1836	792	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 1968	1836	rundll32.exe	WerFault.exe
PID 1836 wrote to memory of 1968	1836	rundll32.exe	WerFault.exe
PID 1836 wrote to memory of 1968	1836	rundll32.exe	WerFault.exe
PID 1836 wrote to memory of 1968	1836	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4db103f3bef49c43c766bc563068be45d617e7dd47d338fe592810c2bf04bc2f.sample.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4db103f3bef49c43c766bc563068be45d617e7dd47d338fe592810c2bf04bc2f.sample.dll,#1
2⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 236
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1968

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-60-0x0000000000000000-mapping.dmp

Download
memory/1836-61-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1968-62-0x0000000000000000-mapping.dmp

Download
memory/1968-63-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads