Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 22:53
Behavioral task
behavioral1
Sample
069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll
-
Size
38KB
-
MD5
0ae9a9dbde008d3361d3fc6f1a9d210f
-
SHA1
ea8bf011b64076a95950bc621c612664cf3e00c5
-
SHA256
069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41
-
SHA512
71ece9aa4211b182f5f2267441c002984b693fed3f76a53282035014443e132511822742d90959a25d69294a016aa3ddcb9875df5e8b5148bfa49fcef38058b4
-
SSDEEP
768:DF2l0FOcZ8mO9yxZuLarzaTOUjU8ii3sIDF6+BwrjL5Rv6nbcuyD7UtD:ICyLarzaTlU3i35VuRv6nouy8tD
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0002000000022df6-135.dat acprotect behavioral2/files/0x0002000000022df6-136.dat acprotect -
resource yara_rule behavioral2/memory/2228-133-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral2/files/0x0002000000022df6-135.dat upx behavioral2/files/0x0002000000022df6-136.dat upx behavioral2/memory/1404-137-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral2/memory/2228-138-0x0000000010000000-0x0000000010022000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1404 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\msdyapi.dll rundll32.exe File opened for modification C:\Windows\msdyapi.dll rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll,1319202174,-2001272773,-1814625877" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2228 2948 rundll32.exe 81 PID 2948 wrote to memory of 2228 2948 rundll32.exe 81 PID 2948 wrote to memory of 2228 2948 rundll32.exe 81 PID 2228 wrote to memory of 1404 2228 rundll32.exe 83 PID 2228 wrote to memory of 1404 2228 rundll32.exe 83 PID 2228 wrote to memory of 1404 2228 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41.dll,#12⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\rundll32.exerundll32 "C:\Windows\msdyapi.dll",_RunAs@163⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1404
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD50ae9a9dbde008d3361d3fc6f1a9d210f
SHA1ea8bf011b64076a95950bc621c612664cf3e00c5
SHA256069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41
SHA51271ece9aa4211b182f5f2267441c002984b693fed3f76a53282035014443e132511822742d90959a25d69294a016aa3ddcb9875df5e8b5148bfa49fcef38058b4
-
Filesize
38KB
MD50ae9a9dbde008d3361d3fc6f1a9d210f
SHA1ea8bf011b64076a95950bc621c612664cf3e00c5
SHA256069ead3529c50522e135859bbd10b0d7dcaa8db7ca2ae558d7ca4d8f50a6ad41
SHA51271ece9aa4211b182f5f2267441c002984b693fed3f76a53282035014443e132511822742d90959a25d69294a016aa3ddcb9875df5e8b5148bfa49fcef38058b4