8cbe3f2030c37221edc54accf8e3480268eb8249ae5bdc073f61156ddd238624

Analysis

max time kernel
150s
max time network
189s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cbe3f2030c37221edc54accf8e3480268eb8249ae5bdc073f61156ddd238624.dll
Size

200KB
MD5

168c92aba433de9ae1d8a3f367037f85
SHA1

bd4d3fa50da4d57c5b8058a92469a425c9bd892c
SHA256

8cbe3f2030c37221edc54accf8e3480268eb8249ae5bdc073f61156ddd238624
SHA512

a402910b8f533da84394aeeaeabd781a83242b837d37ee6decae3ee0f55348b6430c9913be32781977bcc4ce4fe2d310dbc7863b7072598289d2d094373eb540
SSDEEP

3072:IY8VVINB143IWsaBy+d8tpyUC8nL4m+JJXNvdLBZfXD0D3jX61XFXwpZo4:2VA0XB0pyURLARdL/oqXFWD

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

48 1812 rundll32.exe

flow	pid	process
48	1812	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Dcuqozek = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\8cbe3f2030c37221edc54accf8e3480268eb8249ae5bdc073f61156ddd238624.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1812 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1812 rundll32.exe

pid	process
1812	rundll32.exe

pid	process
1812	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1272 wrote to memory of 1812	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1812	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1812	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1812	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1812	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1812	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1812	1272	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cbe3f2030c37221edc54accf8e3480268eb8249ae5bdc073f61156ddd238624.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cbe3f2030c37221edc54accf8e3480268eb8249ae5bdc073f61156ddd238624.dll,#1
2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1812-54-0x0000000000000000-mapping.dmp

Download
memory/1812-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/1812-56-0x0000000010001000-0x0000000010037000-memory.dmp

Filesize
216KB

Download
memory/1812-57-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/1812-60-0x0000000000A31000-0x0000000000A41000-memory.dmp

Filesize
64KB

Download