Analysis
-
max time kernel
50s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-04-2022 13:05
Static task
static1
Behavioral task
behavioral1
Sample
3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll
-
Size
2.0MB
-
MD5
19743d8e8590b5f644d452a9ddd77435
-
SHA1
28c454042b155c4356c2a78b64c25ddf020b8eba
-
SHA256
3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0
-
SHA512
5743c1a3112ee13aefd30f8f3291a32b31e04782c23f03a64c3996d30022c6c5c0051f945450f814a0834758488eb9e0dc3481d706c7b643011cd06c19f8aa71
Score
1/10
Malware Config
Signatures
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3864 ipconfig.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe Token: SeDebugPrivilege 4956 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4884 4956 rundll32.exe 77 PID 4956 wrote to memory of 4884 4956 rundll32.exe 77 PID 4956 wrote to memory of 4300 4956 rundll32.exe 79 PID 4956 wrote to memory of 4300 4956 rundll32.exe 79 PID 4956 wrote to memory of 4848 4956 rundll32.exe 81 PID 4956 wrote to memory of 4848 4956 rundll32.exe 81 PID 4848 wrote to memory of 3864 4848 cmd.exe 83 PID 4848 wrote to memory of 3864 4848 cmd.exe 83 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 5100 4956 rundll32.exe 85 PID 4956 wrote to memory of 5100 4956 rundll32.exe 85 PID 4956 wrote to memory of 5100 4956 rundll32.exe 85 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4188 4956 rundll32.exe 84 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 988 4956 rundll32.exe 87 PID 4956 wrote to memory of 988 4956 rundll32.exe 87 PID 4956 wrote to memory of 988 4956 rundll32.exe 87 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 4872 4956 rundll32.exe 86 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1696 4956 rundll32.exe 89 PID 4956 wrote to memory of 1696 4956 rundll32.exe 89 PID 4956 wrote to memory of 1696 4956 rundll32.exe 89 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88 PID 4956 wrote to memory of 1420 4956 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll,#11⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\System32\cmd.exe/c "dir"2⤵PID:4884
-
-
C:\Windows\System32\cmd.exe/c "set"2⤵PID:4300
-
-
C:\Windows\System32\cmd.exe/c "ipconfig /all"2⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3864
-
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:4188
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:5100
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:4872
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:988
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1420
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1696
-