Analysis
-
max time kernel
268s -
max time network
301s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-10-2021 19:56
Static task
static1
Behavioral task
behavioral1
Sample
Listen.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Listen.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
Listen.dll
-
Size
1.1MB
-
MD5
54a3bcca6b1eb92adb299a46df941826
-
SHA1
6988e010056d88985b8e8f8de06706327779d3ca
-
SHA256
c4ab81d7b7d44dd6dfc4f2b69dbe3f22fbf23c1ae49ab8edac2d26f85ae4514d
-
SHA512
4e4f10abf8a97f649060cb3eaa125a487141a42b87d2dc1449d87531d927031279bd7b48a3859ffa8f5d4400deea77022ecb00c61de8511756dc9c0d27e3f150
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 784 powershell.exe 784 powershell.exe 784 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exerundll32.exerundll32.exedescription pid process Token: SeDebugPrivilege 784 powershell.exe Token: SeShutdownPrivilege 3888 rundll32.exe Token: SeCreatePagefilePrivilege 3888 rundll32.exe Token: SeShutdownPrivilege 3888 rundll32.exe Token: SeCreatePagefilePrivilege 3888 rundll32.exe Token: SeShutdownPrivilege 3652 rundll32.exe Token: SeCreatePagefilePrivilege 3652 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
osk.exepid process 2660 osk.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
osk.exeDllHost.exeDllHost.exepid process 2660 osk.exe 2660 osk.exe 2660 osk.exe 2660 osk.exe 2660 osk.exe 2660 osk.exe 2812 DllHost.exe 2660 osk.exe 2812 DllHost.exe 2660 osk.exe 2460 DllHost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
rundll32.exepowershell.execmd.exerundll32.exedescription pid process target process PID 4012 wrote to memory of 3888 4012 rundll32.exe rundll32.exe PID 4012 wrote to memory of 3888 4012 rundll32.exe rundll32.exe PID 4012 wrote to memory of 3888 4012 rundll32.exe rundll32.exe PID 784 wrote to memory of 3740 784 powershell.exe cmd.exe PID 784 wrote to memory of 3740 784 powershell.exe cmd.exe PID 3740 wrote to memory of 3760 3740 cmd.exe rundll32.exe PID 3740 wrote to memory of 3760 3740 cmd.exe rundll32.exe PID 3760 wrote to memory of 3652 3760 rundll32.exe rundll32.exe PID 3760 wrote to memory of 3652 3760 rundll32.exe rundll32.exe PID 3760 wrote to memory of 3652 3760 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Listen.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Listen.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32 Listen.dll,asd3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 Listen.dll,asd4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe"C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe" -Embedding1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-120-0x000001CE55E00000-0x000001CE55E01000-memory.dmpFilesize
4KB
-
memory/784-138-0x000001CE562A0000-0x000001CE562A1000-memory.dmpFilesize
4KB
-
memory/784-141-0x000001CE53DF0000-0x000001CE53DF2000-memory.dmpFilesize
8KB
-
memory/784-143-0x000001CE53DF3000-0x000001CE53DF5000-memory.dmpFilesize
8KB
-
memory/784-151-0x000001CE56360000-0x000001CE56361000-memory.dmpFilesize
4KB
-
memory/3652-175-0x0000000000000000-mapping.dmp
-
memory/3652-178-0x0000000003250000-0x0000000003251000-memory.dmpFilesize
4KB
-
memory/3652-177-0x0000000072B50000-0x0000000073586000-memory.dmpFilesize
10.2MB
-
memory/3740-171-0x0000000000000000-mapping.dmp
-
memory/3760-174-0x0000000000000000-mapping.dmp
-
memory/3888-114-0x0000000000000000-mapping.dmp
-
memory/3888-160-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/3888-159-0x0000000072B50000-0x0000000073586000-memory.dmpFilesize
10.2MB
-
memory/3888-158-0x0000000072B50000-0x0000000072B7A000-memory.dmpFilesize
168KB