91019710541b9089dd5decbb2713ab7d489cb9962e6fefd1900ea729820217db

Analysis

Target
fb130af92e450cfd1b6ca4ce08e2290d.dll
Size 252KB
Sample211115-24jvcsgfap
SHA256 91019710541b9089dd5decbb2713ab7d489cb9962e6fefd1900ea729820217db
MD5 fb130af92e450cfd1b6ca4ce08e2290d
SHA1 190a9eb78d9978ed824684628f7421335f27689b
SHA512 fd8ef8f26d30c4965660e03d7aeaa7123c1c8e62c18e43c2f54e116595ee6fba2f6e03cb11f2932ed70f39d088cf096210ed1d784e1fa404e7f719615deb4b84
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	3824	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Wtfdqwzbfsdojvp\kopsvxtzgiuwcgk.tlj	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3824	rundll32.exe
3824	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2008	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3780	3444	rundll32.exe	69
PID 3444 wrote to memory of 3780	3444	rundll32.exe	69
PID 3444 wrote to memory of 3780	3444	rundll32.exe	69
PID 3780 wrote to memory of 2008	3780	rundll32.exe	70
PID 3780 wrote to memory of 2008	3780	rundll32.exe	70
PID 3780 wrote to memory of 2008	3780	rundll32.exe	70
PID 2008 wrote to memory of 3988	2008	rundll32.exe	71
PID 2008 wrote to memory of 3988	2008	rundll32.exe	71
PID 2008 wrote to memory of 3988	2008	rundll32.exe	71
PID 3988 wrote to memory of 3824	3988	rundll32.exe	72
PID 3988 wrote to memory of 3824	3988	rundll32.exe	72
PID 3988 wrote to memory of 3824	3988	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb130af92e450cfd1b6ca4ce08e2290d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb130af92e450cfd1b6ca4ce08e2290d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fb130af92e450cfd1b6ca4ce08e2290d.dll",Control_RunDLL
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Wtfdqwzbfsdojvp\kopsvxtzgiuwcgk.tlj",ETrrig
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Wtfdqwzbfsdojvp\kopsvxtzgiuwcgk.tlj",Control_RunDLL
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        
        PID:3824

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3780-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download