de89355883c6e75e912fd9d30a408e11707e6ce8bab1c3cc810dd93a3e3af933

General

Target

de89355883c6e75e912fd9d30a408e11707e6ce8bab1c3cc810dd93a3e3af933.dll
Size

100KB
MD5

06b4d80b33f9383ddc4f2b03f0269a00
SHA1

bb8ddc6d59feb9ce62f2a26b8008161fdac11cd2
SHA256

de89355883c6e75e912fd9d30a408e11707e6ce8bab1c3cc810dd93a3e3af933
SHA512

cf7bfe5ea7067340b00589408699e44d2cd2cf496e0afdea44448d24b887a24bf16b3f4d30e2b1f2d28bae93f3c5cffdf4bac20ede444ab5b8e55d694ca552d6
SSDEEP

3072:MJhn8yXaW+FSgBylUEtCTK3eK7WPUhzoIqWFzJE31My:MJhKbYZ6PRQY6

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
1	904	rundll32.exe
2	1372	rundll32.exe
4	904	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDll = "C:\\PROGRA~3\\2992199F9A\\37frkkf.faa"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDll = "C:\\PROGRA~3\\2992199F9A\\339fa3e3a39dd018cc3c1bab8ec6e70711e804a03d9df219e57e6c38855398ed.faa"	rundll32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1372-56-0x0000000074960000-0x0000000074991000-memory.dmp	upx
behavioral1/memory/1372-59-0x0000000074960000-0x0000000074991000-memory.dmp	upx
behavioral1/memory/904-64-0x0000000074780000-0x00000000747B1000-memory.dmp	upx
behavioral1/memory/904-67-0x0000000074780000-0x00000000747B1000-memory.dmp	upx
behavioral1/memory/1372-68-0x0000000074960000-0x0000000074991000-memory.dmp	upx
behavioral1/memory/904-69-0x0000000074780000-0x00000000747B1000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
904	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\PROGRA~3\2992199F9A\fkkrf73.cpp	rundll32.exe
File created	C:\PROGRA~3\2992199F9A\2193912002.dat	rundll32.exe
File created	C:\PROGRA~3\2992199F9A\37frkkf.bbr	rundll32.exe
File opened for modification	C:\PROGRA~3\2992199F9A\37frkkf.bbr	rundll32.exe
File created	C:\PROGRA~3\2992199F9A\37frkkfAdmin.fdd	rundll32.exe
File created	C:\PROGRA~3\2992199F9A\339fa3e3a39dd018cc3c1bab8ec6e70711e804a03d9df219e57e6c38855398edAdmin.fdd	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
904	rundll32.exe
1372	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1372 wrote to memory of 904	1372	rundll32.exe	27
PID 1372 wrote to memory of 904	1372	rundll32.exe	27
PID 1372 wrote to memory of 904	1372	rundll32.exe	27
PID 1372 wrote to memory of 904	1372	rundll32.exe	27
PID 1372 wrote to memory of 904	1372	rundll32.exe	27
PID 1372 wrote to memory of 904	1372	rundll32.exe	27
PID 1372 wrote to memory of 904	1372	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de89355883c6e75e912fd9d30a408e11707e6ce8bab1c3cc810dd93a3e3af933.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de89355883c6e75e912fd9d30a408e11707e6ce8bab1c3cc810dd93a3e3af933.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Sets DLL path for service in the registry
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\PROGRA~3\299219~1\fkkrf73.cpp,work
    3⤵
    - Blocklisted process makes network request
    - Sets DLL path for service in the registry
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\299219~1\fkkrf73.cpp

Filesize
100KB

MD5
06b4d80b33f9383ddc4f2b03f0269a00

SHA1
bb8ddc6d59feb9ce62f2a26b8008161fdac11cd2

SHA256
de89355883c6e75e912fd9d30a408e11707e6ce8bab1c3cc810dd93a3e3af933

SHA512
cf7bfe5ea7067340b00589408699e44d2cd2cf496e0afdea44448d24b887a24bf16b3f4d30e2b1f2d28bae93f3c5cffdf4bac20ede444ab5b8e55d694ca552d6

Download Submit
\PROGRA~3\299219~1\fkkrf73.cpp

Filesize
100KB

MD5
06b4d80b33f9383ddc4f2b03f0269a00

SHA1
bb8ddc6d59feb9ce62f2a26b8008161fdac11cd2

SHA256
de89355883c6e75e912fd9d30a408e11707e6ce8bab1c3cc810dd93a3e3af933

SHA512
cf7bfe5ea7067340b00589408699e44d2cd2cf496e0afdea44448d24b887a24bf16b3f4d30e2b1f2d28bae93f3c5cffdf4bac20ede444ab5b8e55d694ca552d6

Download Submit
memory/904-60-0x0000000000000000-mapping.dmp

Download
memory/904-64-0x0000000074780000-0x00000000747B1000-memory.dmp

Filesize
196KB

Download
memory/904-67-0x0000000074780000-0x00000000747B1000-memory.dmp

Filesize
196KB

Download
memory/904-69-0x0000000074780000-0x00000000747B1000-memory.dmp

Filesize
196KB

Download
memory/1372-54-0x0000000000000000-mapping.dmp

Download
memory/1372-55-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1372-56-0x0000000074960000-0x0000000074991000-memory.dmp

Filesize
196KB

Download
memory/1372-59-0x0000000074960000-0x0000000074991000-memory.dmp

Filesize
196KB

Download
memory/1372-68-0x0000000074960000-0x0000000074991000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing