Overview

overview

10

Static

static

10

24187dd5b4...53.dll

windows7_x64

3

24187dd5b4...53.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    171s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    10-02-2022 03:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    24187dd5b4f24a5e3ec8b9e69588f59f2883b839de6fd6ae282644b408a7d453.dll

  • Size

    209KB

  • MD5

    3f535607cca76b56fc9beb31be3088fb

  • SHA1

    215c81780a68d5b7e5fb1ff000bc138b9c2f24bb

  • SHA256

    24187dd5b4f24a5e3ec8b9e69588f59f2883b839de6fd6ae282644b408a7d453

  • SHA512

    f60ef14a1c4356b50f8211abc4723aa49ef06033ce5f244c210b45825d7e2b902661b9746d607a3626a548db947c23bee247eda6e8db2d95ce8e6d5445b6fa3d

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\24187dd5b4f24a5e3ec8b9e69588f59f2883b839de6fd6ae282644b408a7d453.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\24187dd5b4f24a5e3ec8b9e69588f59f2883b839de6fd6ae282644b408a7d453.dll,#1
      2⤵
        PID:1404
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 632
          3⤵
          • Program crash
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4728
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1404 -ip 1404
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:1336
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4988
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4232

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4988-130-0x000001EC4ED60000-0x000001EC4ED70000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4988-131-0x000001EC4F320000-0x000001EC4F330000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4988-132-0x000001EC519C0000-0x000001EC519C4000-memory.dmp
      Filesize

      16KB

      Download