dhq.dll

General
Target

dhq.dll

Filesize

712KB

Completed

13-09-2021 17:05

Score
8/10
MD5

6e72b76795624c0cd578c24342453c7c

SHA1

7866fe84f3b53267bfe505bcec20467b05a6e074

SHA256

ebb22358cc0ce4bc40c76e1c02df8d304fd0b27e9793c7cbcc02f23b4e3c1c89

Malware Config
Signatures 6

Filter: none

Discovery
  • Executes dropped EXE
    adobe1.exeadobe1.exe

    Reported IOCs

    pidprocess
    1928adobe1.exe
    1324adobe1.exe
  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1324-70-0x0000000013140000-0x000000001338D000-memory.dmpupx
    behavioral1/memory/1324-74-0x0000000013140000-0x000000001338D000-memory.dmpupx
  • Loads dropped DLL
    rundll32.exeadobe1.exe

    Reported IOCs

    pidprocess
    1956rundll32.exe
    1928adobe1.exe
  • Suspicious use of SetThreadContext
    adobe1.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1928 set thread context of 13241928adobe1.exeadobe1.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious use of WriteProcessMemory
    rundll32.exerundll32.exeadobe1.exeadobe1.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1640 wrote to memory of 19561640rundll32.exerundll32.exe
    PID 1640 wrote to memory of 19561640rundll32.exerundll32.exe
    PID 1640 wrote to memory of 19561640rundll32.exerundll32.exe
    PID 1640 wrote to memory of 19561640rundll32.exerundll32.exe
    PID 1640 wrote to memory of 19561640rundll32.exerundll32.exe
    PID 1640 wrote to memory of 19561640rundll32.exerundll32.exe
    PID 1640 wrote to memory of 19561640rundll32.exerundll32.exe
    PID 1956 wrote to memory of 19281956rundll32.exeadobe1.exe
    PID 1956 wrote to memory of 19281956rundll32.exeadobe1.exe
    PID 1956 wrote to memory of 19281956rundll32.exeadobe1.exe
    PID 1956 wrote to memory of 19281956rundll32.exeadobe1.exe
    PID 1956 wrote to memory of 20441956rundll32.exeAcroRd32.exe
    PID 1956 wrote to memory of 20441956rundll32.exeAcroRd32.exe
    PID 1956 wrote to memory of 20441956rundll32.exeAcroRd32.exe
    PID 1956 wrote to memory of 20441956rundll32.exeAcroRd32.exe
    PID 1928 wrote to memory of 13241928adobe1.exeadobe1.exe
    PID 1928 wrote to memory of 13241928adobe1.exeadobe1.exe
    PID 1928 wrote to memory of 13241928adobe1.exeadobe1.exe
    PID 1928 wrote to memory of 13241928adobe1.exeadobe1.exe
    PID 1928 wrote to memory of 13241928adobe1.exeadobe1.exe
    PID 1928 wrote to memory of 13241928adobe1.exeadobe1.exe
    PID 1324 wrote to memory of 5801324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 5801324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 5801324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 5801324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 5801324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 8521324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 8521324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 8521324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 8521324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 8521324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 17841324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 17841324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 17841324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 17841324adobe1.exeiexplore.exe
    PID 1324 wrote to memory of 17841324adobe1.exeiexplore.exe
Processes 8
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhq.dll,#1
    Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhq.dll,#1
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Users\Admin\AppData\Local\Temp\adobe1.exe
        C:\Users\Admin\AppData\Local\Temp\\adobe1.exe
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Users\Admin\AppData\Local\Temp\adobe1.exe
          C:\Users\Admin\AppData\Local\Temp\\adobe1.exe
          Executes dropped EXE
          Suspicious use of WriteProcessMemory
          PID:1324
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            PID:580
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            PID:852
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            PID:1784
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\reader.pdf"
        PID:2044
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Local\Temp\adobe1.exe

                          MD5

                          fa0469c74632450ff280cda736e3b589

                          SHA1

                          2a125739fc91b38f69c021d8c1e9f66f15da7c1b

                          SHA256

                          9c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9

                          SHA512

                          291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9

                        • C:\Users\Admin\AppData\Local\Temp\adobe1.exe

                          MD5

                          fa0469c74632450ff280cda736e3b589

                          SHA1

                          2a125739fc91b38f69c021d8c1e9f66f15da7c1b

                          SHA256

                          9c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9

                          SHA512

                          291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9

                        • C:\Users\Admin\AppData\Local\Temp\adobe1.exe

                          MD5

                          fa0469c74632450ff280cda736e3b589

                          SHA1

                          2a125739fc91b38f69c021d8c1e9f66f15da7c1b

                          SHA256

                          9c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9

                          SHA512

                          291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9

                        • \Users\Admin\AppData\Local\Temp\adobe1.exe

                          MD5

                          fa0469c74632450ff280cda736e3b589

                          SHA1

                          2a125739fc91b38f69c021d8c1e9f66f15da7c1b

                          SHA256

                          9c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9

                          SHA512

                          291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9

                        • \Users\Admin\AppData\Local\Temp\adobe1.exe

                          MD5

                          fa0469c74632450ff280cda736e3b589

                          SHA1

                          2a125739fc91b38f69c021d8c1e9f66f15da7c1b

                          SHA256

                          9c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9

                          SHA512

                          291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9

                        • memory/1324-71-0x000000001338B560-mapping.dmp

                        • memory/1324-70-0x0000000013140000-0x000000001338D000-memory.dmp

                        • memory/1324-74-0x0000000013140000-0x000000001338D000-memory.dmp

                        • memory/1928-65-0x00000000001C0000-0x00000000001C1000-memory.dmp

                        • memory/1928-63-0x0000000000000000-mapping.dmp

                        • memory/1956-60-0x0000000000000000-mapping.dmp

                        • memory/1956-61-0x0000000075041000-0x0000000075043000-memory.dmp

                        • memory/2044-66-0x0000000000000000-mapping.dmp