Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
24/11/2021, 13:52
Static task
static1
Behavioral task
behavioral1
Sample
1a113863b57da1f6c1c204add25f3def619de6f2.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1a113863b57da1f6c1c204add25f3def619de6f2.dll
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
- Target 1a113863b57da1f6c1c204add25f3def619de6f2.dll
- Size 644KB
- Sample211124-q6d64scggn
- SHA256 97021cfe9acaa2ac1f9fb5a42f108aec3e566b014aea52ef12ed3e446f93f669
- MD5 4715e7d6b18d8f50af1965867b2bb14f
- SHA1 1a113863b57da1f6c1c204add25f3def619de6f2
- SHA512 75406c3dccc3cda9c0d6dcd795eeff15b7b3e9d2511583990bc16d016381d3c7e30c1849fa2f54855a0108ae775020b645813a4c2458f527f284e5f042e355a0
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1348 Process not Found - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gpavvclvseucyal = "C:\\Users\\Admin\\AppData\\Roaming\\Ll4cnt\\VaultSysUi.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\ChkA\mspaint.exe cmd.exe File created C:\Windows\system32\ChkA\mspaint.exe cmd.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1124 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found 1348 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1348 Process not Found - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1348 wrote to memory of 1744 1348 Process not Found 28 PID 1348 wrote to memory of 1744 1348 Process not Found 28 PID 1348 wrote to memory of 1744 1348 Process not Found 28 PID 1348 wrote to memory of 968 1348 Process not Found 29 PID 1348 wrote to memory of 968 1348 Process not Found 29 PID 1348 wrote to memory of 968 1348 Process not Found 29 PID 1348 wrote to memory of 1224 1348 Process not Found 31 PID 1348 wrote to memory of 1224 1348 Process not Found 31 PID 1348 wrote to memory of 1224 1348 Process not Found 31 PID 1348 wrote to memory of 1804 1348 Process not Found 32 PID 1348 wrote to memory of 1804 1348 Process not Found 32 PID 1348 wrote to memory of 1804 1348 Process not Found 32 PID 1348 wrote to memory of 1124 1348 Process not Found 34 PID 1348 wrote to memory of 1124 1348 Process not Found 34 PID 1348 wrote to memory of 1124 1348 Process not Found 34 PID 1348 wrote to memory of 1632 1348 Process not Found 36 PID 1348 wrote to memory of 1632 1348 Process not Found 36 PID 1348 wrote to memory of 1632 1348 Process not Found 36 PID 1348 wrote to memory of 1752 1348 Process not Found 38 PID 1348 wrote to memory of 1752 1348 Process not Found 38 PID 1348 wrote to memory of 1752 1348 Process not Found 38 PID 1348 wrote to memory of 1952 1348 Process not Found 40 PID 1348 wrote to memory of 1952 1348 Process not Found 40 PID 1348 wrote to memory of 1952 1348 Process not Found 40 PID 1348 wrote to memory of 1628 1348 Process not Found 42 PID 1348 wrote to memory of 1628 1348 Process not Found 42 PID 1348 wrote to memory of 1628 1348 Process not Found 42 PID 1348 wrote to memory of 1948 1348 Process not Found 44 PID 1348 wrote to memory of 1948 1348 Process not Found 44 PID 1348 wrote to memory of 1948 1348 Process not Found 44
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a113863b57da1f6c1c204add25f3def619de6f2.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1332
-
C:\Windows\system32\VaultSysUi.exeC:\Windows\system32\VaultSysUi.exe1⤵PID:1744
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\pAPv8.cmd1⤵PID:968
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵PID:1224
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\7xvsl.cmd1⤵
- Drops file in System32 directory
PID:1804
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Qujcgxfoykg" /TR C:\Windows\system32\ChkA\mspaint.exe /SC minute /MO 60 /RL highest1⤵
- Creates scheduled task(s)
PID:1124
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qujcgxfoykg"1⤵PID:1632
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qujcgxfoykg"1⤵PID:1752
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qujcgxfoykg"1⤵PID:1952
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qujcgxfoykg"1⤵PID:1628
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qujcgxfoykg"1⤵PID:1948