Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 05:04
Static task
static1
Behavioral task
behavioral1
Sample
f3bc9be8bc4373044a808690c2da6abbe7f79e37e35c1740a95db89e5317eec4.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f3bc9be8bc4373044a808690c2da6abbe7f79e37e35c1740a95db89e5317eec4.dll
Resource
win10v2004-20220812-en
General
-
Target
f3bc9be8bc4373044a808690c2da6abbe7f79e37e35c1740a95db89e5317eec4.dll
-
Size
3.0MB
-
MD5
4af2e85d017eb90bf88d1fd68c57d4d3
-
SHA1
9e42bf98c1a94f7c57c3a014560407f9cbac0c9a
-
SHA256
f3bc9be8bc4373044a808690c2da6abbe7f79e37e35c1740a95db89e5317eec4
-
SHA512
3a7969f70fbdf12e748bda04b4a8dc4e887f357ab0fdd12c13dc15bb7589f51d4ed685325021b05b8fb16b879cc2f899b917ff830ded931f8fc71bf9f1d9427d
-
SSDEEP
49152:NijLtqc204yRzlzxTG7sSNARK+/5GbmNpRjugxnoc2fFde5r+ly2lV5nrEcXiKfG:NijJ4ARRFTG7szh+WuunF2dMhf2NPZfG
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\f3bc9be8bc4373044a808690c2da6abbe7f79e37e35c1740a95db89e5317eec4 = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\f3bc9be8bc4373044a808690c2da6abbe7f79e37e35c1740a95db89e5317eec4.dll\", DoEntryAction" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4696 wrote to memory of 4860 4696 rundll32.exe rundll32.exe PID 4696 wrote to memory of 4860 4696 rundll32.exe rundll32.exe PID 4696 wrote to memory of 4860 4696 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f3bc9be8bc4373044a808690c2da6abbe7f79e37e35c1740a95db89e5317eec4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f3bc9be8bc4373044a808690c2da6abbe7f79e37e35c1740a95db89e5317eec4.dll,#12⤵
- Adds Run key to start application
PID:4860