Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 14:06
Behavioral task
behavioral1
Sample
0528d945f86be2aae330340548b4acd3f9c0e48a6a2d998c43cd055714c0df78.bin.sample.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
0528d945f86be2aae330340548b4acd3f9c0e48a6a2d998c43cd055714c0df78.bin.sample.dll
Resource
win10-en-20211014
General
-
Target
0528d945f86be2aae330340548b4acd3f9c0e48a6a2d998c43cd055714c0df78.bin.sample.dll
-
Size
8.4MB
-
MD5
2046a3fdc751f79334628ba49e5c5eb6
-
SHA1
864a55bddcab6cdf14aeb69419250ca8c90bc453
-
SHA256
0528d945f86be2aae330340548b4acd3f9c0e48a6a2d998c43cd055714c0df78
-
SHA512
d560acb71b05047a7ab1b03050d508f7d867e53a1d409bb2cd9c6dd05315c846ed3a31c9ee47cc10a0bb26454466033f2c9b5908b8073a66e4945a7d4a9c84b4
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\1195458082.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3068621934.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1776 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1776 taskmgr.exe Token: SeSystemProfilePrivilege 1776 taskmgr.exe Token: SeCreateGlobalPrivilege 1776 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3284 wrote to memory of 364 3284 rundll32.exe rundll32.exe PID 3284 wrote to memory of 364 3284 rundll32.exe rundll32.exe PID 3284 wrote to memory of 364 3284 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0528d945f86be2aae330340548b4acd3f9c0e48a6a2d998c43cd055714c0df78.bin.sample.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0528d945f86be2aae330340548b4acd3f9c0e48a6a2d998c43cd055714c0df78.bin.sample.dll,#12⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-115-0x0000000000000000-mapping.dmp