4b274d8e85fa0cf08bd8c24d029090183db9514fa24b2d181e030d77541b9d04

General

Target

4b274d8e85fa0cf08bd8c24d029090183db9514fa24b2d181e030d77541b9d04.dll
Size

400KB
MD5

7529021780decda9b5fa20445f27d1a5
SHA1

55a3d2791c9d02adecef9296990b1077a84fee6f
SHA256

4b274d8e85fa0cf08bd8c24d029090183db9514fa24b2d181e030d77541b9d04
SHA512

fdd8c5a93d727c94d3f7f3eb3a565a81b570f310ea708e7a4efb83faa27c4ff59e6b0e5f649a17b5a69612160791c7a1feafe1c473042620dc495094ffec1eec
SSDEEP

12288:BttBEGXKSqEpGTIPdYT9tZeXFxJ9X9Ai5P3k:DjvKSqXTIP2ToXFxJ99ZPU

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1748	rundll32mgr.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	upx
behavioral1/files/0x00140000000054ab-57.dat	upx
behavioral1/files/0x00140000000054ab-59.dat	upx
behavioral1/memory/1748-63-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/1748-64-0x0000000000400000-0x0000000000462000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1252	rundll32.exe
1252	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	1252	WerFault.exe	28

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{782BCCF1-41C3-11ED-9AD4-7A3897842414} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371419316"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1748	rundll32mgr.exe
1748	rundll32mgr.exe
1748	rundll32mgr.exe
1748	rundll32mgr.exe
1748	rundll32mgr.exe
1748	rundll32mgr.exe
1748	rundll32mgr.exe
1748	rundll32mgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	rundll32mgr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1252	1776	rundll32.exe	28
PID 1776 wrote to memory of 1252	1776	rundll32.exe	28
PID 1776 wrote to memory of 1252	1776	rundll32.exe	28
PID 1776 wrote to memory of 1252	1776	rundll32.exe	28
PID 1776 wrote to memory of 1252	1776	rundll32.exe	28
PID 1776 wrote to memory of 1252	1776	rundll32.exe	28
PID 1776 wrote to memory of 1252	1776	rundll32.exe	28
PID 1252 wrote to memory of 1748	1252	rundll32.exe	29
PID 1252 wrote to memory of 1748	1252	rundll32.exe	29
PID 1252 wrote to memory of 1748	1252	rundll32.exe	29
PID 1252 wrote to memory of 1748	1252	rundll32.exe	29
PID 1252 wrote to memory of 2044	1252	rundll32.exe	30
PID 1252 wrote to memory of 2044	1252	rundll32.exe	30
PID 1252 wrote to memory of 2044	1252	rundll32.exe	30
PID 1252 wrote to memory of 2044	1252	rundll32.exe	30
PID 1748 wrote to memory of 2004	1748	rundll32mgr.exe	31
PID 1748 wrote to memory of 2004	1748	rundll32mgr.exe	31
PID 1748 wrote to memory of 2004	1748	rundll32mgr.exe	31
PID 1748 wrote to memory of 2004	1748	rundll32mgr.exe	31
PID 1748 wrote to memory of 1720	1748	rundll32mgr.exe	32
PID 1748 wrote to memory of 1720	1748	rundll32mgr.exe	32
PID 1748 wrote to memory of 1720	1748	rundll32mgr.exe	32
PID 1748 wrote to memory of 1720	1748	rundll32mgr.exe	32
PID 2004 wrote to memory of 1392	2004	iexplore.exe	34
PID 2004 wrote to memory of 1392	2004	iexplore.exe	34
PID 2004 wrote to memory of 1392	2004	iexplore.exe	34
PID 2004 wrote to memory of 1392	2004	iexplore.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b274d8e85fa0cf08bd8c24d029090183db9514fa24b2d181e030d77541b9d04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b274d8e85fa0cf08bd8c24d029090183db9514fa24b2d181e030d77541b9d04.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1392
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 228
    3⤵
    - Program crash
    PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\H3K0LATP.txt

Filesize
608B

MD5
0a89fd17a12a6933c654caaebde2a55c

SHA1
99052a7a1c96469fcca7fe8586bb1b240dc34405

SHA256
f95e392dd038757b055a652fbb059765090c193f4db9b2e3ef1510bd05f129d2

SHA512
a58bb2194ad283c385be9b1d43017d9ccf043715b03842cca78d8b3e972d8217a636164b1a103c6e4bdddf0a9a962bf4139b24ab69d20c67162a9dd8f6429f82

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
153KB

MD5
6c6400ba9cf5a1d34fbbb3e2fe57ce3f

SHA1
a6f8636c626b47354407aae3ec592ba8a6ad57ef

SHA256
c33f882e364f65322678d03dbbf00efea35be735c9fdaa74e79f1c3d04191b3a

SHA512
9760704bf0fb51f1da47db1c127d4b312971764866796cbe1fb2989328170bd91e6258f90d1dc3e766cbd61f877cb3b37fd8c30f62dccafd4f1b822bc8255343

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
153KB

MD5
6c6400ba9cf5a1d34fbbb3e2fe57ce3f

SHA1
a6f8636c626b47354407aae3ec592ba8a6ad57ef

SHA256
c33f882e364f65322678d03dbbf00efea35be735c9fdaa74e79f1c3d04191b3a

SHA512
9760704bf0fb51f1da47db1c127d4b312971764866796cbe1fb2989328170bd91e6258f90d1dc3e766cbd61f877cb3b37fd8c30f62dccafd4f1b822bc8255343

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
153KB

MD5
6c6400ba9cf5a1d34fbbb3e2fe57ce3f

SHA1
a6f8636c626b47354407aae3ec592ba8a6ad57ef

SHA256
c33f882e364f65322678d03dbbf00efea35be735c9fdaa74e79f1c3d04191b3a

SHA512
9760704bf0fb51f1da47db1c127d4b312971764866796cbe1fb2989328170bd91e6258f90d1dc3e766cbd61f877cb3b37fd8c30f62dccafd4f1b822bc8255343

Download Submit
memory/1252-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1252-61-0x0000000040000000-0x0000000040064000-memory.dmp

Filesize
400KB

Download
memory/1252-62-0x00000000002C0000-0x0000000000322000-memory.dmp

Filesize
392KB

Download
memory/1748-63-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1748-64-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing