bf9511517f610387d714553bed6ff59d55c21cd0aa18ae00714585e699a332a3

Analysis

Target

4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll
Size

64KB
MD5

ad260da314d2f8f3f1531cc5779cbba9
SHA1

30e15cf49a97e4560c96eed7e0c68ed9a8502023
SHA256

4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91
SHA512

3791b4058ee64bed388b10eeefd733ff45e10c4f374d5644cd4aa10eee6a3fac9bf31076be021acc5c46e8fe79f84048807aaf2c278a5e0e46d41eec00e5e723

Score

10^/10

suricata

suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (paymenthacks .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (paymenthacks .com)
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	656	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
656	rundll32.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
656	rundll32.exe
656	rundll32.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	656	rundll32.exe
Token: SeDebugPrivilege	656	rundll32.exe
Token: 36	656	rundll32.exe
Token: SeImpersonatePrivilege	656	rundll32.exe
Token: SeIncBasePriorityPrivilege	656	rundll32.exe
Token: SeIncreaseQuotaPrivilege	656	rundll32.exe
Token: 33	656	rundll32.exe
Token: SeManageVolumePrivilege	656	rundll32.exe
Token: SeProfSingleProcessPrivilege	656	rundll32.exe
Token: SeRestorePrivilege	656	rundll32.exe
Token: SeSecurityPrivilege	656	rundll32.exe
Token: SeSystemProfilePrivilege	656	rundll32.exe
Token: SeTakeOwnershipPrivilege	656	rundll32.exe
Token: SeShutdownPrivilege	656	rundll32.exe
Token: SeBackupPrivilege	1608	vssvc.exe
Token: SeRestorePrivilege	1608	vssvc.exe
Token: SeAuditPrivilege	1608	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 656	2028	rundll32.exe	28
PID 2028 wrote to memory of 656	2028	rundll32.exe	28
PID 2028 wrote to memory of 656	2028	rundll32.exe	28
PID 2028 wrote to memory of 656	2028	rundll32.exe	28
PID 2028 wrote to memory of 656	2028	rundll32.exe	28
PID 2028 wrote to memory of 656	2028	rundll32.exe	28
PID 2028 wrote to memory of 656	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608

memory/656-56-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/656-58-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/656-57-0x00000000009E5000-0x00000000009F6000-memory.dmp

Filesize
68KB

Download
memory/656-59-0x00000000009F6000-0x00000000009F7000-memory.dmp

Filesize
4KB

Download