4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6

Resubmissions

28/10/2021, 13:03

211028-qal7vagdcj10

23/09/2021, 21:49

210923-1pcbasfcar6

Analysis

max time kernel
146s
max time network
95s
platform
windows7_x64
resource
win7v20210408
submitted
23/09/2021, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll
Size 115KB
Sample210923-1pcbasfcar
SHA256 4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6
MD5 b28aa40baaf219c8b02afa92bc03010f
SHA1 ce3dd7f9fe5e4fb95b68a09f0edac91c52e51b00
SHA512 3128e4902aa5dac607ece489115b64c950643d9c7308de1b91b0711a175091563d2bbe434eb49dc0d92fdc8c162e4e0adb952962b87a9b1c5a385ff3a8b7562d
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\xoihgesukpkfjymwrnndlfuco = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll\", #1 wdtbkqfe khpucsaqn cccneroqoluy"	reg.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1668	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1456	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
992	rundll32.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1976	1828	rundll32.exe	27
PID 1828 wrote to memory of 1976	1828	rundll32.exe	27
PID 1828 wrote to memory of 1976	1828	rundll32.exe	27
PID 1976 wrote to memory of 464	1976	cmd.exe	29
PID 1976 wrote to memory of 464	1976	cmd.exe	29
PID 1976 wrote to memory of 464	1976	cmd.exe	29
PID 1976 wrote to memory of 992	1976	cmd.exe	30
PID 1976 wrote to memory of 992	1976	cmd.exe	30
PID 1976 wrote to memory of 992	1976	cmd.exe	30
PID 992 wrote to memory of 1704	992	rundll32.exe	33
PID 992 wrote to memory of 1704	992	rundll32.exe	33
PID 992 wrote to memory of 1704	992	rundll32.exe	33
PID 1704 wrote to memory of 1456	1704	cmd.exe	35
PID 1704 wrote to memory of 1456	1704	cmd.exe	35
PID 1704 wrote to memory of 1456	1704	cmd.exe	35
PID 992 wrote to memory of 832	992	rundll32.exe	36
PID 992 wrote to memory of 832	992	rundll32.exe	36
PID 992 wrote to memory of 832	992	rundll32.exe	36
PID 832 wrote to memory of 1668	832	cmd.exe	38
PID 832 wrote to memory of 1668	832	cmd.exe	38
PID 832 wrote to memory of 1668	832	cmd.exe	38

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\system32\cmd.exe
  cmd /c choice /c y /d y /t 9 > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll", #1 wdtbkqfe koorgsfd & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\choice.exe
    choice /c y /d y /t 9
    3⤵
    PID:464
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll", #1 wdtbkqfe koorgsfd
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v xoihgesukpkfjymwrnndlfuco /t REG_SZ /d "\"C:\Windows\system32\rundll32.exe\" \"C:\Users\Admin\AppData\Local\Temp\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll\", #1 wdtbkqfe khpucsaqn cccneroqoluy"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Windows\system32\reg.exe
        
        reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v xoihgesukpkfjymwrnndlfuco /t REG_SZ /d "\"C:\Windows\system32\rundll32.exe\" \"C:\Users\Admin\AppData\Local\Temp\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll\", #1 wdtbkqfe khpucsaqn cccneroqoluy"
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1456
  - - C:\Windows\system32\cmd.exe
      cmd /c timeout /t 9 /nobreak & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll", #1 wdtbkqfe khpucsaqn cccneroqoluy & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:832
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 9 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-64-0x0000000000290000-0x00000000002AF000-memory.dmp

Download

memory/1828-60-0x0000000000110000-0x000000000012F000-memory.dmp

Download