Analysis
- max time kernel
123s - max time network
127s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/08/2021, 14:01
Static task
static1
Behavioral task
behavioral1
Sample
3b5ce6a6dfa672d7d1f4c4b9fe0f6571cecea58401bee.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3b5ce6a6dfa672d7d1f4c4b9fe0f6571cecea58401bee.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 3b5ce6a6dfa672d7d1f4c4b9fe0f6571cecea58401bee.dll
- Size 225KB
- Sample210806-cm18zrnxbe
- SHA256 3b5ce6a6dfa672d7d1f4c4b9fe0f6571cecea58401beeb704513a0d97763cb54
- MD5 43d85d7ac639fdb67b756c977c46e03e
- SHA1 dd304803bf067ea3cd9a0a44255fc73c3639d9c1
- SHA512 41cb43ec4bd1111149ce998e2c7caa5ecd9ca0e3ed83483fc3be9fa37a2e1119c7ac6b94a8072b2471f56e1ed161655827767336b9a7cbb2f6dd450e28abccbb
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 39
suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 39
- Blocklisted process makes network request 1 IoCs
flow pid Process 9 1484 rundll32.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\P: rundll32.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1484 rundll32.exe Token: 33 1484 rundll32.exe Token: SeIncBasePriorityPrivilege 1484 rundll32.exe Token: 33 1484 rundll32.exe Token: SeIncBasePriorityPrivilege 1484 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 996 wrote to memory of 1484 996 rundll32.exe 71 PID 996 wrote to memory of 1484 996 rundll32.exe 71 PID 996 wrote to memory of 1484 996 rundll32.exe 71
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b5ce6a6dfa672d7d1f4c4b9fe0f6571cecea58401bee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b5ce6a6dfa672d7d1f4c4b9fe0f6571cecea58401bee.dll,#12⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484
-