Analysis
- max time kernel
151s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
24/11/2021, 13:52
General
- Target 1a113863b57da1f6c1c204add25f3def619de6f2.dll
- Size 644KB
- Sample211124-q6d64scggn
- SHA256 97021cfe9acaa2ac1f9fb5a42f108aec3e566b014aea52ef12ed3e446f93f669
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a113863b57da1f6c1c204add25f3def619de6f2.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\BlB.cmd1⤵
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\A4brjQ5.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Cokctydopemaqrj" /TR C:\Windows\system32\CA9N\xpsrchvw.exe /SC minute /MO 60 /RL highest1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cokctydopemaqrj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cokctydopemaqrj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cokctydopemaqrj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cokctydopemaqrj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cokctydopemaqrj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cokctydopemaqrj"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1920-142-0x0000000000CD0000-0x0000000000CD2000-memory.dmp
memory/1920-146-0x0000000000CD0000-0x0000000000CD2000-memory.dmp
memory/1920-131-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/1920-132-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/1920-133-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/1920-134-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/1920-135-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/1920-136-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/1920-141-0x0000000000CD0000-0x0000000000CD2000-memory.dmp
memory/1920-124-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/1920-143-0x00007FF8B58E5000-0x00007FF8B58E6000-memory.dmp
memory/1920-144-0x0000000000CD0000-0x0000000000CD2000-memory.dmp
memory/1920-145-0x00007FF8B5A20000-0x00007FF8B5A22000-memory.dmp
memory/1920-130-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/1920-126-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/1920-127-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/1920-129-0x0000000140000000-0x00000001400A1000-memory.dmp
memory/2716-125-0x0000025F183C0000-0x0000025F183C2000-memory.dmp
memory/2716-128-0x0000025F183C0000-0x0000025F183C2000-memory.dmp
memory/2716-118-0x00007FF8A9590000-0x00007FF8A9631000-memory.dmp
memory/2716-123-0x0000025F183B0000-0x0000025F183B7000-memory.dmp
memory/2716-122-0x0000025F183C0000-0x0000025F183C2000-memory.dmp
memory/2716-121-0x0000025F183C0000-0x0000025F183C2000-memory.dmp