Overview

overview

10

Static

static

10

d6c53d9341...25.dll

windows7_x64

6

d6c53d9341...25.dll

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    28-01-2022 18:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d6c53d9341dda1252ada3861898840be4d669abae2b983ab9bf5259b84de7525.dll

  • Size

    130KB

  • MD5

    0f270db9ab9361e20058b8c6129bf30e

  • SHA1

    ffc0baa6c0a16d9b2ff92402c909106154f15d33

  • SHA256

    d6c53d9341dda1252ada3861898840be4d669abae2b983ab9bf5259b84de7525

  • SHA512

    83ce2d7998fcc9f4777e075319447bd57f540fe6aa421d9cf6b8a45f1452097aecc77c257fe25883de555f03c8ab51611f64c3976de737d9738ec0c3d9dfc1cb

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6c53d9341dda1252ada3861898840be4d669abae2b983ab9bf5259b84de7525.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6c53d9341dda1252ada3861898840be4d669abae2b983ab9bf5259b84de7525.dll,#1
      2⤵
      • Enumerates connected drives
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:804
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 280
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/804-54-0x0000000075341000-0x0000000075343000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1876-56-0x00000000002B0000-0x00000000002B1000-memory.dmp
    Filesize

    4KB

    Download