Analysis
-
max time kernel
212s -
max time network
227s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:57
Static task
static1
Behavioral task
behavioral1
Sample
dada1a069616dc8367f2da525cb2b559bfe687fa0a930805baf40c302b1afe02.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dada1a069616dc8367f2da525cb2b559bfe687fa0a930805baf40c302b1afe02.dll
Resource
win10v2004-20221111-en
General
-
Target
dada1a069616dc8367f2da525cb2b559bfe687fa0a930805baf40c302b1afe02.dll
-
Size
120KB
-
MD5
d6aac766722818344699d277ef183799
-
SHA1
17119452215bffb14b44a38d058ed115b06f3b26
-
SHA256
dada1a069616dc8367f2da525cb2b559bfe687fa0a930805baf40c302b1afe02
-
SHA512
f325b50b4966abe6c1bf0b59bbe46cdf9748e4905f50502dd62626993a6a336ec3bc0a761645576f71cb44019615a5f49c9378b3e1586a61e6047666efb89110
-
SSDEEP
3072:tPFvWgfwxgtoDZMBSqEEuFhH2k0GxXcbg0JslR593P/vyExtyHD1:tPFNZto+SqEnFhHRxXcbgDP/zUHD
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kkalokimakige = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dada1a069616dc8367f2da525cb2b559bfe687fa0a930805baf40c302b1afe02.dll\",Startup" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
rundll32.exepid process 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe 308 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
rundll32.exerundll32.exepid process 308 rundll32.exe 3084 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4664 wrote to memory of 308 4664 rundll32.exe rundll32.exe PID 4664 wrote to memory of 308 4664 rundll32.exe rundll32.exe PID 4664 wrote to memory of 308 4664 rundll32.exe rundll32.exe PID 308 wrote to memory of 3084 308 rundll32.exe rundll32.exe PID 308 wrote to memory of 3084 308 rundll32.exe rundll32.exe PID 308 wrote to memory of 3084 308 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dada1a069616dc8367f2da525cb2b559bfe687fa0a930805baf40c302b1afe02.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dada1a069616dc8367f2da525cb2b559bfe687fa0a930805baf40c302b1afe02.dll,#12⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\dada1a069616dc8367f2da525cb2b559bfe687fa0a930805baf40c302b1afe02.dll",iep3⤵
- Suspicious use of SetWindowsHookEx
PID:3084