Analysis
- max time kernel
50s - max time network
63s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
15/04/2022, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll
- Size 2.0MB
- Sample220415-qb13dsdde9
- SHA256 3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0
- MD5 19743d8e8590b5f644d452a9ddd77435
- SHA1 28c454042b155c4356c2a78b64c25ddf020b8eba
- SHA512 5743c1a3112ee13aefd30f8f3291a32b31e04782c23f03a64c3996d30022c6c5c0051f945450f814a0834758488eb9e0dc3481d706c7b643011cd06c19f8aa71
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3864 ipconfig.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command rundll32.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4884 4956 rundll32.exe 77 PID 4956 wrote to memory of 4884 4956 rundll32.exe 77 PID 4956 wrote to memory of 4300 4956 rundll32.exe 79 PID 4956 wrote to memory of 4300 4956 rundll32.exe 79 PID 4956 wrote to memory of 4848 4956 rundll32.exe 81 PID 4956 wrote to memory of 4848 4956 rundll32.exe 81 PID 4848 wrote to memory of 3864 4848 cmd.exe 83 PID 4848 wrote to memory of 3864 4848 cmd.exe 83 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 5100 4956 rundll32.exe 85 PID 4956 wrote to memory of 5100 4956 rundll32.exe 85 PID 4956 wrote to memory of 5100 4956 rundll32.exe 85 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 988 4956 rundll32.exe 87 PID 4956 wrote to memory of 988 4956 rundll32.exe 87 PID 4956 wrote to memory of 988 4956 rundll32.exe 87 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1696 4956 rundll32.exe 89 PID 4956 wrote to memory of 1696 4956 rundll32.exe 89 PID 4956 wrote to memory of 1696 4956 rundll32.exe 89 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll,#11⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\System32\cmd.exe/c "dir"2⤵PID:4884
-
-
C:\Windows\System32\cmd.exe/c "set"2⤵PID:4300
-
-
C:\Windows\System32\cmd.exe/c "ipconfig /all"2⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3864
-
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:4188
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:5100
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:4872
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:988
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1420
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1696
-