bf9511517f610387d714553bed6ff59d55c21cd0aa18ae00714585e699a332a3

Analysis

Target

4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll
Size

64KB
MD5

ad260da314d2f8f3f1531cc5779cbba9
SHA1

30e15cf49a97e4560c96eed7e0c68ed9a8502023
SHA256

4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91
SHA512

3791b4058ee64bed388b10eeefd733ff45e10c4f374d5644cd4aa10eee6a3fac9bf31076be021acc5c46e8fe79f84048807aaf2c278a5e0e46d41eec00e5e723

Score

10^/10

suricata

suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (paymenthacks .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (paymenthacks .com)
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 656 rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

656 rundll32.exe
Modifies Control Panel 1 IoCs
evasion

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

656 rundll32.exe
656 rundll32.exe

flow	pid	process
5	656	rundll32.exe

pid	process
656	rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International	rundll32.exe

pid	process
656	rundll32.exe
656	rundll32.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

rundll32.exevssvc.exe

description	pid	process
Token: SeBackupPrivilege	656	rundll32.exe
Token: SeDebugPrivilege	656	rundll32.exe
Token: 36	656	rundll32.exe
Token: SeImpersonatePrivilege	656	rundll32.exe
Token: SeIncBasePriorityPrivilege	656	rundll32.exe
Token: SeIncreaseQuotaPrivilege	656	rundll32.exe
Token: 33	656	rundll32.exe
Token: SeManageVolumePrivilege	656	rundll32.exe
Token: SeProfSingleProcessPrivilege	656	rundll32.exe
Token: SeRestorePrivilege	656	rundll32.exe
Token: SeSecurityPrivilege	656	rundll32.exe
Token: SeSystemProfilePrivilege	656	rundll32.exe
Token: SeTakeOwnershipPrivilege	656	rundll32.exe
Token: SeShutdownPrivilege	656	rundll32.exe
Token: SeBackupPrivilege	1608	vssvc.exe
Token: SeRestorePrivilege	1608	vssvc.exe
Token: SeAuditPrivilege	1608	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 656	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 656	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 656	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 656	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 656	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 656	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 656	2028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608

memory/656-55-0x0000000000000000-mapping.dmp

Download
memory/656-56-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/656-58-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/656-57-0x00000000009E5000-0x00000000009F6000-memory.dmp

Filesize
68KB

Download
memory/656-59-0x00000000009F6000-0x00000000009F7000-memory.dmp

Filesize
4KB

Download