Analysis

  • max time kernel
    103s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2022 20:33

General

  • Target

    4123.do1.dll

  • Size

    48KB

  • MD5

    f776deb4df137b37dcae5406c8f3a07a

  • SHA1

    f6a31b594fca39c118927405fa4d14353b8fd49a

  • SHA256

    93cc5e6a6b671d9b0124ade32ae8b09269de9f03c5c5e66347fbfc7a8c3b305e

  • SHA512

    4077b4214b4683bb4776d470027e61fcc3cb3e78beb9377674e4a4de9115d52911e39cb29a566ab446c6962a252ce01020ffd616b5854a9d8230414262bfafe2

  • SSDEEP

    768:fw2jnhaqqUgQeONXr27iLAkfP69FyfQZWBS:hjnEQeON727CA2G

Score
10/10

Malware Config

Signatures

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

  • Nloader payload ⋅ 4 IoCs
  • Program crash ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4123.do1.dll,#1
    Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4123.do1.dll,#1
      PID:424
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 904
        Program crash
        PID:3548
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 424 -ip 424
    PID:2812

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/424-132-0x0000000000000000-mapping.dmp
                          • memory/424-133-0x00000000014E0000-0x00000000014E9000-memory.dmp
                          • memory/424-137-0x0000000002FE0000-0x0000000002FE7000-memory.dmp
                          • memory/424-140-0x0000000003000000-0x0000000003005000-memory.dmp
                          • memory/424-143-0x00000000014B0000-0x00000000014B6000-memory.dmp