Analysis
- max time kernel
45s - max time network
49s - platform
windows7_x64 - resource
win7-20220414-en - submitted
15/04/2022, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll
- Size 2.0MB
- Sample220415-qb13dsdde9
- SHA256 3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0
- MD5 19743d8e8590b5f644d452a9ddd77435
- SHA1 28c454042b155c4356c2a78b64c25ddf020b8eba
- SHA512 5743c1a3112ee13aefd30f8f3291a32b31e04782c23f03a64c3996d30022c6c5c0051f945450f814a0834758488eb9e0dc3481d706c7b643011cd06c19f8aa71
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2036 ipconfig.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command rundll32.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1504 rundll32.exe Token: SeDebugPrivilege 1504 rundll32.exe Token: SeDebugPrivilege 1504 rundll32.exe Token: SeDebugPrivilege 1504 rundll32.exe Token: SeDebugPrivilege 1504 rundll32.exe Token: SeDebugPrivilege 1504 rundll32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1504 wrote to memory of 360 1504 rundll32.exe 27 PID 1504 wrote to memory of 360 1504 rundll32.exe 27 PID 1504 wrote to memory of 360 1504 rundll32.exe 27 PID 1504 wrote to memory of 536 1504 rundll32.exe 29 PID 1504 wrote to memory of 536 1504 rundll32.exe 29 PID 1504 wrote to memory of 536 1504 rundll32.exe 29 PID 1504 wrote to memory of 1916 1504 rundll32.exe 31 PID 1504 wrote to memory of 1916 1504 rundll32.exe 31 PID 1504 wrote to memory of 1916 1504 rundll32.exe 31 PID 1916 wrote to memory of 2036 1916 cmd.exe 33 PID 1916 wrote to memory of 2036 1916 cmd.exe 33 PID 1916 wrote to memory of 2036 1916 cmd.exe 33 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 984 1504 rundll32.exe 35 PID 1504 wrote to memory of 984 1504 rundll32.exe 35 PID 1504 wrote to memory of 984 1504 rundll32.exe 35 PID 1504 wrote to memory of 984 1504 rundll32.exe 35 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1984 1504 rundll32.exe 34 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1088 1504 rundll32.exe 39 PID 1504 wrote to memory of 1088 1504 rundll32.exe 39 PID 1504 wrote to memory of 1088 1504 rundll32.exe 39 PID 1504 wrote to memory of 1088 1504 rundll32.exe 39 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1020 1504 rundll32.exe 38 PID 1504 wrote to memory of 1600 1504 rundll32.exe 41 PID 1504 wrote to memory of 1600 1504 rundll32.exe 41 PID 1504 wrote to memory of 1600 1504 rundll32.exe 41 PID 1504 wrote to memory of 1608 1504 rundll32.exe 42 PID 1504 wrote to memory of 1608 1504 rundll32.exe 42 PID 1504 wrote to memory of 1608 1504 rundll32.exe 42 PID 1504 wrote to memory of 1608 1504 rundll32.exe 42 PID 1504 wrote to memory of 1600 1504 rundll32.exe 41 PID 1504 wrote to memory of 1600 1504 rundll32.exe 41 PID 1504 wrote to memory of 1600 1504 rundll32.exe 41
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll,#11⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\System32\cmd.exe/c "dir"2⤵PID:360
-
-
C:\Windows\System32\cmd.exe/c "set"2⤵PID:536
-
-
C:\Windows\System32\cmd.exe/c "ipconfig /all"2⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2036
-
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1984
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:984
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1020
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1088
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1600
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1608
-