Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2022, 04:50
Static task
static1
Behavioral task
behavioral1
Sample
eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll
Resource
win7-20220812-en
General
-
Target
eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll
-
Size
72KB
-
MD5
2585c0fe09d2f03a82dae7a18e76b9af
-
SHA1
63f4bff1c9fa6ee0f493b3db7f8b93f0cd09e22c
-
SHA256
eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9
-
SHA512
33a7b10e5f2d1fa0d41be38085c33500b7a3a6f9a079fc11a4225d72406afd51839cbb60dd52c2e7e8c230490f11b243b8e001b757e3900c0e96561c39f34398
-
SSDEEP
1536:QstOC7PazOFn058YaUxwjYi+GhOambg5pRDi6gcW:NNIxwjhubyDiMW
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2484-139-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2484-140-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 2484 rundll32.exe Token: SeTcbPrivilege 2484 rundll32.exe Token: SeChangeNotifyPrivilege 2484 rundll32.exe Token: SeCreateTokenPrivilege 2484 rundll32.exe Token: SeBackupPrivilege 2484 rundll32.exe Token: SeRestorePrivilege 2484 rundll32.exe Token: SeIncreaseQuotaPrivilege 2484 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2484 rundll32.exe Token: SeImpersonatePrivilege 2484 rundll32.exe Token: SeTcbPrivilege 2484 rundll32.exe Token: SeChangeNotifyPrivilege 2484 rundll32.exe Token: SeCreateTokenPrivilege 2484 rundll32.exe Token: SeBackupPrivilege 2484 rundll32.exe Token: SeRestorePrivilege 2484 rundll32.exe Token: SeIncreaseQuotaPrivilege 2484 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2484 rundll32.exe Token: SeImpersonatePrivilege 2484 rundll32.exe Token: SeTcbPrivilege 2484 rundll32.exe Token: SeChangeNotifyPrivilege 2484 rundll32.exe Token: SeCreateTokenPrivilege 2484 rundll32.exe Token: SeBackupPrivilege 2484 rundll32.exe Token: SeRestorePrivilege 2484 rundll32.exe Token: SeIncreaseQuotaPrivilege 2484 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2484 rundll32.exe Token: SeImpersonatePrivilege 2484 rundll32.exe Token: SeTcbPrivilege 2484 rundll32.exe Token: SeChangeNotifyPrivilege 2484 rundll32.exe Token: SeCreateTokenPrivilege 2484 rundll32.exe Token: SeBackupPrivilege 2484 rundll32.exe Token: SeRestorePrivilege 2484 rundll32.exe Token: SeIncreaseQuotaPrivilege 2484 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2484 rundll32.exe Token: SeImpersonatePrivilege 2484 rundll32.exe Token: SeTcbPrivilege 2484 rundll32.exe Token: SeChangeNotifyPrivilege 2484 rundll32.exe Token: SeCreateTokenPrivilege 2484 rundll32.exe Token: SeBackupPrivilege 2484 rundll32.exe Token: SeRestorePrivilege 2484 rundll32.exe Token: SeIncreaseQuotaPrivilege 2484 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2484 rundll32.exe Token: SeImpersonatePrivilege 2484 rundll32.exe Token: SeTcbPrivilege 2484 rundll32.exe Token: SeChangeNotifyPrivilege 2484 rundll32.exe Token: SeCreateTokenPrivilege 2484 rundll32.exe Token: SeBackupPrivilege 2484 rundll32.exe Token: SeRestorePrivilege 2484 rundll32.exe Token: SeIncreaseQuotaPrivilege 2484 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2484 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2484 2368 rundll32.exe 81 PID 2368 wrote to memory of 2484 2368 rundll32.exe 81 PID 2368 wrote to memory of 2484 2368 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484
-