Analysis
-
max time kernel
68s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2022 20:40
Static task
static1
Behavioral task
behavioral1
Sample
d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll
-
Size
1.1MB
-
MD5
0c02dcf6109dde488973cbb7039bbce0
-
SHA1
b79fd1ea630031b6884b5f7db33bd69a83db3ef2
-
SHA256
d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2
-
SHA512
dcf95180af45bcd00ebccb9b282428590ccd915cb286e01b6550dde3823bc80864603a2e826f767bc9100e87a183bae1a404a5c623caf91bac489215f8e6157d
-
SSDEEP
24576:DnpCMj+KpP5Wx6QpBf+Vf0a6v9SG8Bk+sc/poFAPVW+VhWGs:fId40pv8G8Bk/c/pouVW+LWG
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4852 rundll32Srv.exe -
resource yara_rule behavioral2/files/0x0007000000022e46-135.dat upx behavioral2/files/0x0007000000022e46-134.dat upx behavioral2/memory/4852-137-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4852-138-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaprst.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcor.dll rundll32Srv.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\eventlog_provider.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll rundll32Srv.exe File opened for modification C:\Program Files\Internet Explorer\hmmapi.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\7z.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\7zG.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\micaut.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll rundll32Srv.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcer.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\System\ado\msadrh15.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll rundll32Srv.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2088 2236 rundll32.exe 20 PID 2236 wrote to memory of 2088 2236 rundll32.exe 20 PID 2236 wrote to memory of 2088 2236 rundll32.exe 20 PID 2088 wrote to memory of 4852 2088 rundll32.exe 84 PID 2088 wrote to memory of 4852 2088 rundll32.exe 84 PID 2088 wrote to memory of 4852 2088 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\rundll32Srv.exeC:\Windows\SysWOW64\rundll32Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4852
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD59f7f94a22e1ed7f03995292038b35b98
SHA1c4c5a6e26687e788b3a0859aa0e6f1917a7334c2
SHA256a7a43eef41b32a366e865ca71c160ff23e831cce9a28937ff7cd212acd2109e3
SHA512f775bbddc1f594984c5f7d7b88d211d5ddbd54d2fed1c92ae11b5007f6ef3e00b614f729253c77b8f1471b328dbd6be585309414b4310f0c2840dedb9a743bb4
-
Filesize
10KB
MD59f7f94a22e1ed7f03995292038b35b98
SHA1c4c5a6e26687e788b3a0859aa0e6f1917a7334c2
SHA256a7a43eef41b32a366e865ca71c160ff23e831cce9a28937ff7cd212acd2109e3
SHA512f775bbddc1f594984c5f7d7b88d211d5ddbd54d2fed1c92ae11b5007f6ef3e00b614f729253c77b8f1471b328dbd6be585309414b4310f0c2840dedb9a743bb4