dff2e259f1c14058a985b9121938ac6ef7835302ce617faf0a26a9c80df1e9da

Analysis

max time kernel
160s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dff2e259f1c14058a985b9121938ac6ef7835302ce617faf0a26a9c80df1e9da.dll
Size 260KB
Sample221011-hagclaaebl
SHA256 dff2e259f1c14058a985b9121938ac6ef7835302ce617faf0a26a9c80df1e9da
MD5 4987f529bdcff0dfc782c316bf23ab1b
SHA1 6f013b94e8b01816219762f5e41c1fe243cc25a9
SHA512 d84bd0f503c951b66396023e93cc59db409e971e204b8e1ce474d81fb677715bfb1f1f1e2b671c48ce5ae8dcb84b010997b162f04dff6afe6fb9f85a4ebea31e
SSDEEP 6144:FM3pimKTzijA+cD3BsXTwF6tqDR/iDYiPvWVk9HaXjqlAtFS2OteRg/NGPeEC4V:UpvKXaMuJqDhiDYiPuGGaY42A0g/NQeo
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
21	4680	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Aliyojike = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dff2e259f1c14058a985b9121938ac6ef7835302ce617faf0a26a9c80df1e9da.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4680	rundll32.exe
4680	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4680	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4680	1524	rundll32.exe	80
PID 1524 wrote to memory of 4680	1524	rundll32.exe	80
PID 1524 wrote to memory of 4680	1524	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dff2e259f1c14058a985b9121938ac6ef7835302ce617faf0a26a9c80df1e9da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dff2e259f1c14058a985b9121938ac6ef7835302ce617faf0a26a9c80df1e9da.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4680-133-0x0000000010000000-0x0000000010049000-memory.dmp

Download

memory/4680-136-0x0000000002EF0000-0x0000000002FF0000-memory.dmp

Download

memory/4680-137-0x0000000002EF0000-0x0000000002FF0000-memory.dmp

Download