Analysis
-
max time kernel
60s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-04-2022 05:54
Static task
static1
Behavioral task
behavioral1
Sample
b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8.dll
-
Size
2.1MB
-
MD5
ce4a1572a1c6c4aa5e5731d44f3a1db0
-
SHA1
8cf9e66744745fad5928ed8406db339e01a75de6
-
SHA256
b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8
-
SHA512
1b98807d18ff14b537f34d0697eecb3e88b4f18f2a5f65169cae5c4d7aa1f8b8028f4c5935eec757e702863b7189d27c13b4886d2b41a5288821e316bfe68b88
Score
10/10
Malware Config
Signatures
-
suricata: ET MALWARE ComRAT CnC Domain in DNS Lookup
suricata: ET MALWARE ComRAT CnC Domain in DNS Lookup
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1812 ipconfig.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1120 rundll32.exe Token: SeDebugPrivilege 1120 rundll32.exe Token: SeDebugPrivilege 1120 rundll32.exe Token: SeDebugPrivilege 1120 rundll32.exe Token: SeDebugPrivilege 1120 rundll32.exe Token: SeDebugPrivilege 1120 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 1668 1120 rundll32.exe 28 PID 1120 wrote to memory of 1668 1120 rundll32.exe 28 PID 1120 wrote to memory of 1668 1120 rundll32.exe 28 PID 1120 wrote to memory of 1528 1120 rundll32.exe 30 PID 1120 wrote to memory of 1528 1120 rundll32.exe 30 PID 1120 wrote to memory of 1528 1120 rundll32.exe 30 PID 1120 wrote to memory of 1328 1120 rundll32.exe 32 PID 1120 wrote to memory of 1328 1120 rundll32.exe 32 PID 1120 wrote to memory of 1328 1120 rundll32.exe 32 PID 1328 wrote to memory of 1812 1328 cmd.exe 34 PID 1328 wrote to memory of 1812 1328 cmd.exe 34 PID 1328 wrote to memory of 1812 1328 cmd.exe 34 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1204 1120 rundll32.exe 36 PID 1120 wrote to memory of 1204 1120 rundll32.exe 36 PID 1120 wrote to memory of 1204 1120 rundll32.exe 36 PID 1120 wrote to memory of 1204 1120 rundll32.exe 36 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 1972 1120 rundll32.exe 35 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 1032 1120 rundll32.exe 40 PID 1120 wrote to memory of 1032 1120 rundll32.exe 40 PID 1120 wrote to memory of 1032 1120 rundll32.exe 40 PID 1120 wrote to memory of 1032 1120 rundll32.exe 40 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 568 1120 rundll32.exe 39 PID 1120 wrote to memory of 268 1120 rundll32.exe 42 PID 1120 wrote to memory of 268 1120 rundll32.exe 42 PID 1120 wrote to memory of 268 1120 rundll32.exe 42 PID 1120 wrote to memory of 1504 1120 rundll32.exe 43 PID 1120 wrote to memory of 1504 1120 rundll32.exe 43 PID 1120 wrote to memory of 1504 1120 rundll32.exe 43 PID 1120 wrote to memory of 1504 1120 rundll32.exe 43 PID 1120 wrote to memory of 268 1120 rundll32.exe 42 PID 1120 wrote to memory of 268 1120 rundll32.exe 42 PID 1120 wrote to memory of 268 1120 rundll32.exe 42 PID 1120 wrote to memory of 268 1120 rundll32.exe 42 PID 1120 wrote to memory of 268 1120 rundll32.exe 42
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8.dll,#11⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\cmd.exe/c "dir"2⤵PID:1668
-
-
C:\Windows\System32\cmd.exe/c "set"2⤵PID:1528
-
-
C:\Windows\System32\cmd.exe/c "ipconfig /all"2⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1812
-
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1972
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1204
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:568
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1032
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:268
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1504
-