Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 00:57
Static task
static1
Behavioral task
behavioral1
Sample
2bc93648ffc475cd4e5258f381132866cddfd8c0d5adf6be3d6218cb750ac5f3.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2bc93648ffc475cd4e5258f381132866cddfd8c0d5adf6be3d6218cb750ac5f3.dll
Resource
win10v2004-20220414-en
General
-
Target
2bc93648ffc475cd4e5258f381132866cddfd8c0d5adf6be3d6218cb750ac5f3.dll
-
Size
164KB
-
MD5
ea08eab00bd36a9669d4594e3e1a219e
-
SHA1
b936291ce6ff28985aaec7d9369bb6af3e4caf7a
-
SHA256
2bc93648ffc475cd4e5258f381132866cddfd8c0d5adf6be3d6218cb750ac5f3
-
SHA512
001f046068e93f65d5c975571e4e13662e79d2390c49d3eb0caa68848d609528f0c51b2bb948d6ed110f3e75235574a1e2e8603e6866ecd81b1d81cb051a2959
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\V: rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepowershell.exepid process 4580 rundll32.exe 4580 rundll32.exe 548 powershell.exe 548 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
rundll32.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 4580 rundll32.exe Token: SeDebugPrivilege 548 powershell.exe Token: SeBackupPrivilege 2688 vssvc.exe Token: SeRestorePrivilege 2688 vssvc.exe Token: SeAuditPrivilege 2688 vssvc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2280 wrote to memory of 4580 2280 rundll32.exe rundll32.exe PID 2280 wrote to memory of 4580 2280 rundll32.exe rundll32.exe PID 2280 wrote to memory of 4580 2280 rundll32.exe rundll32.exe PID 4580 wrote to memory of 548 4580 rundll32.exe powershell.exe PID 4580 wrote to memory of 548 4580 rundll32.exe powershell.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc93648ffc475cd4e5258f381132866cddfd8c0d5adf6be3d6218cb750ac5f3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc93648ffc475cd4e5258f381132866cddfd8c0d5adf6be3d6218cb750ac5f3.dll,#12⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/548-131-0x0000000000000000-mapping.dmp
-
memory/548-132-0x00000275E9E90000-0x00000275E9EB2000-memory.dmpFilesize
136KB
-
memory/548-133-0x00007FF8BA280000-0x00007FF8BAD41000-memory.dmpFilesize
10.8MB
-
memory/548-134-0x00007FF8BA280000-0x00007FF8BAD41000-memory.dmpFilesize
10.8MB
-
memory/4580-130-0x0000000000000000-mapping.dmp