bf9511517f610387d714553bed6ff59d55c21cd0aa18ae00714585e699a332a3

Analysis

Target

4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll
Size

64KB
MD5

ad260da314d2f8f3f1531cc5779cbba9
SHA1

30e15cf49a97e4560c96eed7e0c68ed9a8502023
SHA256

4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91
SHA512

3791b4058ee64bed388b10eeefd733ff45e10c4f374d5644cd4aa10eee6a3fac9bf31076be021acc5c46e8fe79f84048807aaf2c278a5e0e46d41eec00e5e723

Score

10^/10

suricata

suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (paymenthacks .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (paymenthacks .com)
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	1556	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1556	rundll32.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1556	rundll32.exe
1556	rundll32.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	1556	rundll32.exe
Token: SeDebugPrivilege	1556	rundll32.exe
Token: 36	1556	rundll32.exe
Token: SeImpersonatePrivilege	1556	rundll32.exe
Token: SeIncBasePriorityPrivilege	1556	rundll32.exe
Token: SeIncreaseQuotaPrivilege	1556	rundll32.exe
Token: 33	1556	rundll32.exe
Token: SeManageVolumePrivilege	1556	rundll32.exe
Token: SeProfSingleProcessPrivilege	1556	rundll32.exe
Token: SeRestorePrivilege	1556	rundll32.exe
Token: SeSecurityPrivilege	1556	rundll32.exe
Token: SeSystemProfilePrivilege	1556	rundll32.exe
Token: SeTakeOwnershipPrivilege	1556	rundll32.exe
Token: SeShutdownPrivilege	1556	rundll32.exe
Token: SeBackupPrivilege	3740	vssvc.exe
Token: SeRestorePrivilege	3740	vssvc.exe
Token: SeAuditPrivilege	3740	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1556	1776	rundll32.exe	68
PID 1776 wrote to memory of 1556	1776	rundll32.exe	68
PID 1776 wrote to memory of 1556	1776	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740

memory/1556-120-0x0000000003190000-0x00000000032DA000-memory.dmp

Filesize
1.3MB

Download
memory/1556-119-0x0000000003190000-0x00000000032DA000-memory.dmp

Filesize
1.3MB

Download