0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561

General

Target

0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561.dll
Size

132KB
MD5

a2831f7853731b81715f241bd9f35462
SHA1

958678130f379f456b92a2e806aa16d8a1749aaa
SHA256

0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561
SHA512

f35d1693171bd32d6d966f2dca61b9871f4f07fe12d16bb7226dd66faa284be47edf9d793129e3b41f5f2e60cbe3c1641b8a9f7e6609a941104c896d3013556b
SSDEEP

3072:yREL2hDBTjkJlUub06rN6eE8/o2X5kg2bHOL5PFn0wcccccccc:UTd203qt2g2bH0PFn0wcccccccc

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	1172	rundll32.exe
2	1696	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
1696	rundll32.exe
1696	rundll32.exe
1696	rundll32.exe
1696	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\{27712167-4B84-4855-A244-3561A0DB93E0} = "rundll32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\{27712167-4B84-4855-A244-3561A0DB93E0}\\576a.dll\",DllGetClassObject secret 11954"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1172	rundll32.exe
1696	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1824 wrote to memory of 1172	1824	rundll32.exe	27
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\{27712167-4B84-4855-A244-3561A0DB93E0}\576a.dll",DllGetClassObject secret 11954
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{27712167-4B84-4855-A244-3561A0DB93E0}\576a.dll

Filesize
132KB

MD5
a2831f7853731b81715f241bd9f35462

SHA1
958678130f379f456b92a2e806aa16d8a1749aaa

SHA256
0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561

SHA512
f35d1693171bd32d6d966f2dca61b9871f4f07fe12d16bb7226dd66faa284be47edf9d793129e3b41f5f2e60cbe3c1641b8a9f7e6609a941104c896d3013556b

Download Submit
\Users\Admin\AppData\Local\Temp\{27712167-4B84-4855-A244-3561A0DB93E0}\576a.dll

Filesize
132KB

MD5
a2831f7853731b81715f241bd9f35462

SHA1
958678130f379f456b92a2e806aa16d8a1749aaa

SHA256
0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561

SHA512
f35d1693171bd32d6d966f2dca61b9871f4f07fe12d16bb7226dd66faa284be47edf9d793129e3b41f5f2e60cbe3c1641b8a9f7e6609a941104c896d3013556b

Download Submit
\Users\Admin\AppData\Local\Temp\{27712167-4B84-4855-A244-3561A0DB93E0}\576a.dll

Filesize
132KB

MD5
a2831f7853731b81715f241bd9f35462

SHA1
958678130f379f456b92a2e806aa16d8a1749aaa

SHA256
0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561

SHA512
f35d1693171bd32d6d966f2dca61b9871f4f07fe12d16bb7226dd66faa284be47edf9d793129e3b41f5f2e60cbe3c1641b8a9f7e6609a941104c896d3013556b

Download Submit
\Users\Admin\AppData\Local\Temp\{27712167-4B84-4855-A244-3561A0DB93E0}\576a.dll

Filesize
132KB

MD5
a2831f7853731b81715f241bd9f35462

SHA1
958678130f379f456b92a2e806aa16d8a1749aaa

SHA256
0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561

SHA512
f35d1693171bd32d6d966f2dca61b9871f4f07fe12d16bb7226dd66faa284be47edf9d793129e3b41f5f2e60cbe3c1641b8a9f7e6609a941104c896d3013556b

Download Submit
\Users\Admin\AppData\Local\Temp\{27712167-4B84-4855-A244-3561A0DB93E0}\576a.dll

Filesize
132KB

MD5
a2831f7853731b81715f241bd9f35462

SHA1
958678130f379f456b92a2e806aa16d8a1749aaa

SHA256
0d723d6033957741d40a19985abe557803e692f70ab63e2add4c0cf09ee2a561

SHA512
f35d1693171bd32d6d966f2dca61b9871f4f07fe12d16bb7226dd66faa284be47edf9d793129e3b41f5f2e60cbe3c1641b8a9f7e6609a941104c896d3013556b

Download Submit
memory/1172-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1172-56-0x0000000074560000-0x000000007458C000-memory.dmp

Filesize
176KB

Download
memory/1172-58-0x00000000007E0000-0x00000000008E0000-memory.dmp

Filesize
1024KB

Download
memory/1696-66-0x0000000074170000-0x000000007419C000-memory.dmp

Filesize
176KB

Download
memory/1696-68-0x00000000003D0000-0x00000000004D0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing