Analysis
-
max time kernel
38s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:13
Static task
static1
Behavioral task
behavioral1
Sample
5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f.dll
Resource
win7-20221111-en
General
-
Target
5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f.dll
-
Size
876KB
-
MD5
57c9d8fe23f8940f2adf63544e5cab34
-
SHA1
15a8a06fb1f753f090eb3863f931ffd3c5d78daf
-
SHA256
5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f
-
SHA512
97f9a998901cc5dee1cb0735d0f46064dfd28297e9b1656708b10761aa82d3fc49892cc0c443450df481c3b1c952662cdf33c705d7bedfa306aeb85e6af48587
-
SSDEEP
12288:UPTv+CFW4hPdahP/RN2kU7fWS36pweWGJr619QV4qqxEnEk3D6qC5UjuEOTRPa94:UPSH4hQP/RN2fLqNK9QV4qBH1AM94
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 1988 rundll32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/1988-62-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1988-64-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1988-66-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 1064 rundll32.exe 1064 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
Processes:
rundll32mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxD21F.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32mgr.exepid process 1988 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 24 IoCs
Processes:
rundll32mgr.exepid process 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe 1988 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32mgr.exedescription pid process Token: SeDebugPrivilege 1988 rundll32mgr.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
rundll32mgr.exepid process 1988 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exedescription pid process target process PID 2016 wrote to memory of 1064 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1064 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1064 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1064 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1064 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1064 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1064 2016 rundll32.exe rundll32.exe PID 1064 wrote to memory of 1988 1064 rundll32.exe rundll32mgr.exe PID 1064 wrote to memory of 1988 1064 rundll32.exe rundll32mgr.exe PID 1064 wrote to memory of 1988 1064 rundll32.exe rundll32mgr.exe PID 1064 wrote to memory of 1988 1064 rundll32.exe rundll32mgr.exe PID 1988 wrote to memory of 368 1988 rundll32mgr.exe wininit.exe PID 1988 wrote to memory of 368 1988 rundll32mgr.exe wininit.exe PID 1988 wrote to memory of 368 1988 rundll32mgr.exe wininit.exe PID 1988 wrote to memory of 368 1988 rundll32mgr.exe wininit.exe PID 1988 wrote to memory of 368 1988 rundll32mgr.exe wininit.exe PID 1988 wrote to memory of 368 1988 rundll32mgr.exe wininit.exe PID 1988 wrote to memory of 368 1988 rundll32mgr.exe wininit.exe PID 1988 wrote to memory of 384 1988 rundll32mgr.exe csrss.exe PID 1988 wrote to memory of 384 1988 rundll32mgr.exe csrss.exe PID 1988 wrote to memory of 384 1988 rundll32mgr.exe csrss.exe PID 1988 wrote to memory of 384 1988 rundll32mgr.exe csrss.exe PID 1988 wrote to memory of 384 1988 rundll32mgr.exe csrss.exe PID 1988 wrote to memory of 384 1988 rundll32mgr.exe csrss.exe PID 1988 wrote to memory of 384 1988 rundll32mgr.exe csrss.exe PID 1988 wrote to memory of 420 1988 rundll32mgr.exe winlogon.exe PID 1988 wrote to memory of 420 1988 rundll32mgr.exe winlogon.exe PID 1988 wrote to memory of 420 1988 rundll32mgr.exe winlogon.exe PID 1988 wrote to memory of 420 1988 rundll32mgr.exe winlogon.exe PID 1988 wrote to memory of 420 1988 rundll32mgr.exe winlogon.exe PID 1988 wrote to memory of 420 1988 rundll32mgr.exe winlogon.exe PID 1988 wrote to memory of 420 1988 rundll32mgr.exe winlogon.exe PID 1988 wrote to memory of 468 1988 rundll32mgr.exe services.exe PID 1988 wrote to memory of 468 1988 rundll32mgr.exe services.exe PID 1988 wrote to memory of 468 1988 rundll32mgr.exe services.exe PID 1988 wrote to memory of 468 1988 rundll32mgr.exe services.exe PID 1988 wrote to memory of 468 1988 rundll32mgr.exe services.exe PID 1988 wrote to memory of 468 1988 rundll32mgr.exe services.exe PID 1988 wrote to memory of 468 1988 rundll32mgr.exe services.exe PID 1988 wrote to memory of 476 1988 rundll32mgr.exe lsass.exe PID 1988 wrote to memory of 476 1988 rundll32mgr.exe lsass.exe PID 1988 wrote to memory of 476 1988 rundll32mgr.exe lsass.exe PID 1988 wrote to memory of 476 1988 rundll32mgr.exe lsass.exe PID 1988 wrote to memory of 476 1988 rundll32mgr.exe lsass.exe PID 1988 wrote to memory of 476 1988 rundll32mgr.exe lsass.exe PID 1988 wrote to memory of 476 1988 rundll32mgr.exe lsass.exe PID 1988 wrote to memory of 484 1988 rundll32mgr.exe lsm.exe PID 1988 wrote to memory of 484 1988 rundll32mgr.exe lsm.exe PID 1988 wrote to memory of 484 1988 rundll32mgr.exe lsm.exe PID 1988 wrote to memory of 484 1988 rundll32mgr.exe lsm.exe PID 1988 wrote to memory of 484 1988 rundll32mgr.exe lsm.exe PID 1988 wrote to memory of 484 1988 rundll32mgr.exe lsm.exe PID 1988 wrote to memory of 484 1988 rundll32mgr.exe lsm.exe PID 1988 wrote to memory of 592 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 592 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 592 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 592 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 592 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 592 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 592 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 668 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 668 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 668 1988 rundll32mgr.exe svchost.exe PID 1988 wrote to memory of 668 1988 rundll32mgr.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:480
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:272
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1088
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:1028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:848
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:808
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:592
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:1956
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1640
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1988
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1188
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\SYSWOW64\RUNDLL32MGR.EXEFilesize
211KB
MD5e1b0d496aa15f2189e5ecfad81d36456
SHA1a58707563d183c55d40f16e461cd0bbe8acca529
SHA25605690e8e01ff53f41cdb3e3043dedcded9b7306134c416ba2e11dc53e54e245d
SHA512eeb18da576574b296a077affa792554ed230ffc7fa2289e02f73f73d385d5f8dc37a9e3bc65d4643486be2e7b6243fc9ce798eb478c3e05fafa7932cb58a853a
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
211KB
MD5e1b0d496aa15f2189e5ecfad81d36456
SHA1a58707563d183c55d40f16e461cd0bbe8acca529
SHA25605690e8e01ff53f41cdb3e3043dedcded9b7306134c416ba2e11dc53e54e245d
SHA512eeb18da576574b296a077affa792554ed230ffc7fa2289e02f73f73d385d5f8dc37a9e3bc65d4643486be2e7b6243fc9ce798eb478c3e05fafa7932cb58a853a
-
\Windows\SysWOW64\rundll32mgr.exeFilesize
211KB
MD5e1b0d496aa15f2189e5ecfad81d36456
SHA1a58707563d183c55d40f16e461cd0bbe8acca529
SHA25605690e8e01ff53f41cdb3e3043dedcded9b7306134c416ba2e11dc53e54e245d
SHA512eeb18da576574b296a077affa792554ed230ffc7fa2289e02f73f73d385d5f8dc37a9e3bc65d4643486be2e7b6243fc9ce798eb478c3e05fafa7932cb58a853a
-
\Windows\SysWOW64\rundll32mgr.exeFilesize
211KB
MD5e1b0d496aa15f2189e5ecfad81d36456
SHA1a58707563d183c55d40f16e461cd0bbe8acca529
SHA25605690e8e01ff53f41cdb3e3043dedcded9b7306134c416ba2e11dc53e54e245d
SHA512eeb18da576574b296a077affa792554ed230ffc7fa2289e02f73f73d385d5f8dc37a9e3bc65d4643486be2e7b6243fc9ce798eb478c3e05fafa7932cb58a853a
-
memory/1064-54-0x0000000000000000-mapping.dmp
-
memory/1064-55-0x0000000075531000-0x0000000075533000-memory.dmpFilesize
8KB
-
memory/1064-63-0x000000007EFA0000-0x000000007EFAA000-memory.dmpFilesize
40KB
-
memory/1988-58-0x0000000000000000-mapping.dmp
-
memory/1988-62-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1988-64-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1988-66-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB