1ec64142dc7e17e1a377133c33285801e927f4e1a146cd88f8cd5967d433d896

General

Target

1ec64142dc7e17e1a377133c33285801e927f4e1a146cd88f8cd5967d433d896.dll
Size

115KB
MD5

568ccbeb3c9f19ad3ac5c90078a44788
SHA1

9e039b666fad69c1e8124d02715e6ae52d84c086
SHA256

1ec64142dc7e17e1a377133c33285801e927f4e1a146cd88f8cd5967d433d896
SHA512

96fd05f016e061b8f5f6713c0d307e1dab4f9bea006242b16730d8edd52b87e4aae650e823475777e1bfaea3734e6dae87001c755919373d429dd7299e36c39e
SSDEEP

1536:KGnTnqbXBOx3RUXQZeS+4oCARrg2dJfz+y:LnjSROx3RSQZeS+4HA5gJy

Score

8^/10

evasion upx

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4744-137-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4744-141-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

2720 sc.exe
1676 sc.exe
1764 sc.exe
2788 sc.exe

pid	process
2720	sc.exe
1676	sc.exe
1764	sc.exe
2788	sc.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rundll32.exesvchost.exe

description pid process

Token: SeDebugPrivilege 4744 rundll32.exe
Token: SeAuditPrivilege 4188 svchost.exe

description	pid	process
Token: SeDebugPrivilege	4744	rundll32.exe
Token: SeAuditPrivilege	4188	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2260 wrote to memory of 4744	2260	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 4744	2260	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 4744	2260	rundll32.exe	rundll32.exe
PID 4744 wrote to memory of 2972	4744	rundll32.exe	reg.exe
PID 4744 wrote to memory of 2972	4744	rundll32.exe	reg.exe
PID 4744 wrote to memory of 2972	4744	rundll32.exe	reg.exe
PID 4744 wrote to memory of 2720	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 2720	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 2720	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 1676	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 1676	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 1676	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 1764	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 1764	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 1764	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 2788	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 2788	4744	rundll32.exe	sc.exe
PID 4744 wrote to memory of 2788	4744	rundll32.exe	sc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ec64142dc7e17e1a377133c33285801e927f4e1a146cd88f8cd5967d433d896.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ec64142dc7e17e1a377133c33285801e927f4e1a146cd88f8cd5967d433d896.dll,#1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe import "C:\Users\Admin\kxef.avi"
3⤵
PID:2972

C:\Windows\SysWOW64\sc.exe
C:\Windows\System32\sc.exe config PolicyAgent start=auto
3⤵
- Launches sc.exe
PID:2720

C:\Windows\SysWOW64\sc.exe
C:\Windows\System32\sc.exe stop PolicyAgent
3⤵
- Launches sc.exe
PID:1676

C:\Windows\SysWOW64\sc.exe
C:\Windows\System32\sc.exe start PolicyAgent
3⤵
- Launches sc.exe
PID:1764

C:\Windows\SysWOW64\sc.exe
C:\Windows\System32\sc.exe stop PolicyAgent
3⤵
- Launches sc.exe
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\kxef.avi
Filesize
56KB

MD5
bc8025bc98da7f4ed891c9f9991d3ff1

SHA1
70a69a7fcebe9b43f00a1fa713e3a0621bf3ac6d

SHA256
59b9dc39d69f8b0aa350f550e42e632b396237865776d0ce75477f8fe3f9016f

SHA512
7f772261e003d2df9162ae4aeaab2bda674ee2721b3300cc8b2a2f4904af6bc9c565c7f2c3e67a7394eb1a387860a2544fc5bdc3e6de384b664f8d232ad6acf5

Download Submit
memory/1676-138-0x0000000000000000-mapping.dmp

Download
memory/1764-139-0x0000000000000000-mapping.dmp

Download
memory/2720-136-0x0000000000000000-mapping.dmp

Download
memory/2788-140-0x0000000000000000-mapping.dmp

Download
memory/2972-134-0x0000000000000000-mapping.dmp

Download
memory/4744-133-0x0000000000000000-mapping.dmp

Download
memory/4744-137-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4744-141-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads