860589476a74b83dfff2fb7440783d9808247616ffca135f5337412f890a95c1

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

860589476a74b83dfff2fb7440783d9808247616ffca135f5337412f890a95c1.dll
Size

176KB
MD5

6dc054f1c0eb818bcd8bfbcc337fa920
SHA1

bfcdd5fd791846bada77c3976e13e8a29448f105
SHA256

860589476a74b83dfff2fb7440783d9808247616ffca135f5337412f890a95c1
SHA512

82fdb68e9cb3e8a410f47fb00595a1f6184740f0603e2313f750cf2b4692441e54d8ab989e93b21bb745b02cca196f0292bc1fa498446a1ec9ce9e091f3aff2e
SSDEEP

1536:EQSH2AGIJ2aJs6aZ5jE5wuhcBa8yw4KclQBHTxRtHIeidbSn8PJMECdMZ:EtHY42aKZ5Huuc8VDyuntoBhMECaZ

Score

8^/10

upx

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
13	1016	rundll32.exe
28	1016	rundll32.exe
38	1016	rundll32.exe
40	1016	rundll32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5024-133-0x0000000074B90000-0x0000000074BC2000-memory.dmp	upx
behavioral2/memory/5024-136-0x0000000074B90000-0x0000000074BC2000-memory.dmp	upx
behavioral2/memory/1016-140-0x0000000074B40000-0x0000000074B72000-memory.dmp	upx
behavioral2/memory/1016-143-0x0000000074B40000-0x0000000074B72000-memory.dmp	upx
behavioral2/memory/5024-144-0x0000000074B90000-0x0000000074BC2000-memory.dmp	upx
behavioral2/memory/1016-145-0x0000000074B40000-0x0000000074B72000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1016	rundll32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\PROGRA~3\xj8jzjr8.gsa	rundll32.exe
File created	C:\PROGRA~3\8rjzj8jx.bbr	rundll32.exe
File opened for modification	C:\PROGRA~3\8rjzj8jx.bbr	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 5024	4976	rundll32.exe	81
PID 4976 wrote to memory of 5024	4976	rundll32.exe	81
PID 4976 wrote to memory of 5024	4976	rundll32.exe	81
PID 5024 wrote to memory of 1016	5024	rundll32.exe	82
PID 5024 wrote to memory of 1016	5024	rundll32.exe	82
PID 5024 wrote to memory of 1016	5024	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\860589476a74b83dfff2fb7440783d9808247616ffca135f5337412f890a95c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\860589476a74b83dfff2fb7440783d9808247616ffca135f5337412f890a95c1.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\PROGRA~3\xj8jzjr8.gsa,MMS1
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\xj8jzjr8.gsa

Filesize
176KB

MD5
6dc054f1c0eb818bcd8bfbcc337fa920

SHA1
bfcdd5fd791846bada77c3976e13e8a29448f105

SHA256
860589476a74b83dfff2fb7440783d9808247616ffca135f5337412f890a95c1

SHA512
82fdb68e9cb3e8a410f47fb00595a1f6184740f0603e2313f750cf2b4692441e54d8ab989e93b21bb745b02cca196f0292bc1fa498446a1ec9ce9e091f3aff2e

Download Submit
C:\ProgramData\xj8jzjr8.gsa

Filesize
176KB

MD5
6dc054f1c0eb818bcd8bfbcc337fa920

SHA1
bfcdd5fd791846bada77c3976e13e8a29448f105

SHA256
860589476a74b83dfff2fb7440783d9808247616ffca135f5337412f890a95c1

SHA512
82fdb68e9cb3e8a410f47fb00595a1f6184740f0603e2313f750cf2b4692441e54d8ab989e93b21bb745b02cca196f0292bc1fa498446a1ec9ce9e091f3aff2e

Download Submit
memory/1016-137-0x0000000000000000-mapping.dmp

Download
memory/1016-140-0x0000000074B40000-0x0000000074B72000-memory.dmp

Filesize
200KB

Download
memory/1016-143-0x0000000074B40000-0x0000000074B72000-memory.dmp

Filesize
200KB

Download
memory/1016-145-0x0000000074B40000-0x0000000074B72000-memory.dmp

Filesize
200KB

Download
memory/5024-132-0x0000000000000000-mapping.dmp

Download
memory/5024-133-0x0000000074B90000-0x0000000074BC2000-memory.dmp

Filesize
200KB

Download
memory/5024-136-0x0000000074B90000-0x0000000074BC2000-memory.dmp

Filesize
200KB

Download
memory/5024-144-0x0000000074B90000-0x0000000074BC2000-memory.dmp

Filesize
200KB

Download