Analysis
-
max time kernel
80s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-10-2022 22:53
Behavioral task
behavioral1
Sample
069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll
-
Size
38KB
-
MD5
0ae9a9dbde008d3361d3fc6f1a9d210f
-
SHA1
ea8bf011b64076a95950bc621c612664cf3e00c5
-
SHA256
069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41
-
SHA512
71ece9aa4211b182f5f2267441c002984b693fed3f76a53282035014443e132511822742d90959a25d69294a016aa3ddcb9875df5e8b5148bfa49fcef38058b4
-
SSDEEP
768:DF2l0FOcZ8mO9yxZuLarzaTOUjU8ii3sIDF6+BwrjL5Rv6nbcuyD7UtD:ICyLarzaTlU3i35VuRv6nouy8tD
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000c0000000054a8-59.dat acprotect -
resource yara_rule behavioral1/memory/1948-56-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral1/files/0x000c0000000054a8-59.dat upx behavioral1/memory/1336-60-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral1/memory/1948-61-0x0000000010000000-0x0000000010022000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\msdyapi.dll rundll32.exe File opened for modification C:\Windows\msdyapi.dll rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll,1319202174,-2001272773,-1814625877" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1948 1944 rundll32.exe 14 PID 1944 wrote to memory of 1948 1944 rundll32.exe 14 PID 1944 wrote to memory of 1948 1944 rundll32.exe 14 PID 1944 wrote to memory of 1948 1944 rundll32.exe 14 PID 1944 wrote to memory of 1948 1944 rundll32.exe 14 PID 1944 wrote to memory of 1948 1944 rundll32.exe 14 PID 1944 wrote to memory of 1948 1944 rundll32.exe 14 PID 1948 wrote to memory of 1336 1948 rundll32.exe 28 PID 1948 wrote to memory of 1336 1948 rundll32.exe 28 PID 1948 wrote to memory of 1336 1948 rundll32.exe 28 PID 1948 wrote to memory of 1336 1948 rundll32.exe 28 PID 1948 wrote to memory of 1336 1948 rundll32.exe 28 PID 1948 wrote to memory of 1336 1948 rundll32.exe 28 PID 1948 wrote to memory of 1336 1948 rundll32.exe 28
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll,#11⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\rundll32.exerundll32 "C:\Windows\msdyapi.dll",_RunAs@162⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1336
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1944
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD507adfdd9337643f17994bbd3c1d44f87
SHA112de9de3a6377e821a572004c240871fb23639a9
SHA256194ed9c69e35a2cadee113817a58f9052837810c103a9602c839b50bcaaa1934
SHA5121e34e58c14d45cc86a82d26a42ee70c66d23d45562733a4890bd301d5d9db726a09ec6f6775425bdd8d2eacfdcb5fccebd851bd1b1f582848ec3dbd85694fbd4