Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-04-2022 02:22
Static task
static1
Behavioral task
behavioral1
Sample
d0a4ab1f0e390d232ff3790f6569f31915fbdab40f2b6d1813f8ffbdc83c3b9f.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
d0a4ab1f0e390d232ff3790f6569f31915fbdab40f2b6d1813f8ffbdc83c3b9f.dll
Resource
win10v2004-20220414-en
General
-
Target
d0a4ab1f0e390d232ff3790f6569f31915fbdab40f2b6d1813f8ffbdc83c3b9f.dll
-
Size
97KB
-
MD5
644f833fce3d075c4a0cc44cdc59e0fd
-
SHA1
2aa95fa0d93a1a678e0bd891bdb5f990ab930a83
-
SHA256
d0a4ab1f0e390d232ff3790f6569f31915fbdab40f2b6d1813f8ffbdc83c3b9f
-
SHA512
3c2ab610126b750e6cb7d49fce723b157cc6da80fa20477c68d7e0de06b35f319352940faff43c37afbb1214f54e8482ca4837571a7d610a746d04e538bb86c0
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
Processes:
rundll32.exeflow pid process 1 2024 rundll32.exe 2 2024 rundll32.exe 3 2024 rundll32.exe 4 2024 rundll32.exe 5 2024 rundll32.exe 6 2024 rundll32.exe 7 2024 rundll32.exe 8 2024 rundll32.exe 9 2024 rundll32.exe 10 2024 rundll32.exe 11 2024 rundll32.exe 12 2024 rundll32.exe 13 2024 rundll32.exe 14 2024 rundll32.exe 15 2024 rundll32.exe 16 2024 rundll32.exe 17 2024 rundll32.exe 18 2024 rundll32.exe 20 2024 rundll32.exe 21 2024 rundll32.exe 22 2024 rundll32.exe 23 2024 rundll32.exe 24 2024 rundll32.exe 25 2024 rundll32.exe 26 2024 rundll32.exe 27 2024 rundll32.exe 28 2024 rundll32.exe 29 2024 rundll32.exe 30 2024 rundll32.exe 31 2024 rundll32.exe 32 2024 rundll32.exe 33 2024 rundll32.exe 34 2024 rundll32.exe 35 2024 rundll32.exe 36 2024 rundll32.exe 37 2024 rundll32.exe 38 2024 rundll32.exe 39 2024 rundll32.exe 40 2024 rundll32.exe 41 2024 rundll32.exe 42 2024 rundll32.exe 43 2024 rundll32.exe 44 2024 rundll32.exe 45 2024 rundll32.exe 46 2024 rundll32.exe 47 2024 rundll32.exe 48 2024 rundll32.exe 49 2024 rundll32.exe 50 2024 rundll32.exe 51 2024 rundll32.exe 52 2024 rundll32.exe 53 2024 rundll32.exe 54 2024 rundll32.exe 55 2024 rundll32.exe 56 2024 rundll32.exe 57 2024 rundll32.exe 58 2024 rundll32.exe 59 2024 rundll32.exe 60 2024 rundll32.exe 61 2024 rundll32.exe 62 2024 rundll32.exe 63 2024 rundll32.exe 64 2024 rundll32.exe 65 2024 rundll32.exe -
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
Processes:
flow ioc 187 aegijmamiijq.bazar 41 dcegjldkggjp.bazar 44 dcegjldkggjp.bazar 119 ddehimdlghiq.bazar 127 ddegkmdlggkq.bazar 140 ddegkmdlggkq.bazar 168 bdfgilblhgip.bazar 178 bdfgilblhgip.bazar 46 dcegjldkggjp.bazar 67 bdegjkblggjo.bazar 76 bdegjkblggjo.bazar 111 ddehimdlghiq.bazar 130 ddegkmdlggkq.bazar 172 bdfgilblhgip.bazar 195 aegijmamiijq.bazar 53 dcegjldkggjp.bazar 59 dcegjldkggjp.bazar 80 bdegjkblggjo.bazar 151 ddegkmdlggkq.bazar 154 bdfgilblhgip.bazar 193 aegijmamiijq.bazar 177 bdfgilblhgip.bazar 42 dcegjldkggjp.bazar 79 bdegjkblggjo.bazar 89 bdegjkblggjo.bazar 123 ddegkmdlggkq.bazar 132 ddegkmdlggkq.bazar 146 ddegkmdlggkq.bazar 161 bdfgilblhgip.bazar 186 aegijmamiijq.bazar 188 aegijmamiijq.bazar 194 aegijmamiijq.bazar 33 dcegjldkggjp.bazar 38 dcegjldkggjp.bazar 115 ddehimdlghiq.bazar 143 ddegkmdlggkq.bazar 174 bdfgilblhgip.bazar 182 aegijmamiijq.bazar 71 bdegjkblggjo.bazar 85 bdegjkblggjo.bazar 108 ddehimdlghiq.bazar 133 ddegkmdlggkq.bazar 183 aegijmamiijq.bazar 138 ddegkmdlggkq.bazar 66 bdegjkblggjo.bazar 68 bdegjkblggjo.bazar 97 ddehimdlghiq.bazar 99 ddehimdlghiq.bazar 104 ddehimdlghiq.bazar 117 ddehimdlghiq.bazar 120 ddehimdlghiq.bazar 180 bdfgilblhgip.bazar 47 dcegjldkggjp.bazar 50 dcegjldkggjp.bazar 78 bdegjkblggjo.bazar 103 ddehimdlghiq.bazar 134 ddegkmdlggkq.bazar 171 bdfgilblhgip.bazar 191 aegijmamiijq.bazar 81 bdegjkblggjo.bazar 179 bdfgilblhgip.bazar 189 aegijmamiijq.bazar 122 ddegkmdlggkq.bazar 141 ddegkmdlggkq.bazar -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 69.164.196.21 Destination IP 77.73.68.161 Destination IP 69.164.196.21 Destination IP 185.164.136.225 Destination IP 172.98.193.42 Destination IP 167.99.153.82 Destination IP 217.12.210.54 Destination IP 82.141.39.32 Destination IP 139.59.23.241 Destination IP 167.99.153.82 Destination IP 185.121.177.177 Destination IP 169.239.202.202 Destination IP 63.231.92.27 Destination IP 185.164.136.225 Destination IP 45.32.160.206 Destination IP 217.12.210.54 Destination IP 5.135.183.146 Destination IP 185.164.136.225 Destination IP 45.32.160.206 Destination IP 208.67.222.222 Destination IP 142.4.205.47 Destination IP 142.4.205.47 Destination IP 163.172.185.51 Destination IP 5.45.97.127 Destination IP 5.135.183.146 Destination IP 5.135.183.146 Destination IP 185.121.177.177 Destination IP 5.45.97.127 Destination IP 96.47.228.108 Destination IP 208.67.220.220 Destination IP 192.99.85.244 Destination IP 142.4.204.111 Destination IP 208.67.222.222 Destination IP 45.63.124.65 Destination IP 142.4.204.111 Destination IP 163.172.185.51 Destination IP 94.177.171.127 Destination IP 96.47.228.108 Destination IP 163.172.185.51 Destination IP 89.35.39.64 Destination IP 139.59.23.241 Destination IP 172.98.193.42 Destination IP 51.255.211.146 Destination IP 142.4.204.111 Destination IP 172.104.136.243 Destination IP 45.32.160.206 Destination IP 172.104.136.243 Destination IP 63.231.92.27 Destination IP 167.99.153.82 Destination IP 142.4.204.111 Destination IP 139.59.23.241 Destination IP 185.121.177.177 Destination IP 172.98.193.42 Destination IP 172.104.136.243 Destination IP 217.12.210.54 Destination IP 192.99.85.244 Destination IP 82.141.39.32 Destination IP 208.67.220.220 Destination IP 217.12.210.54 Destination IP 89.35.39.64 Destination IP 167.99.153.82 Destination IP 45.63.124.65 Destination IP 208.67.222.222 Destination IP 163.172.185.51 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 2024 rundll32.exe