fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4

General

Target

fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe
Size

117KB
MD5

73494d224c401b61fb57e0e2dd7d2ac5
SHA1

e4d73fb15c26a798534c588b1e3d668d38842e11
SHA256

fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4
SHA512

58ae4015b6f8a8d344dfaf34a01f9c0a2771104340354594295e9158ee099693f2550f43da7b80ec895d2f16affa451365ef07d70b1a1c74bc2b0bf304340878
SSDEEP

3072:VuzrTIH0dm/ppuKY+NL5q/dDx+jiF9lqBIHoz2zDruy:VuvTIUdezYQLMpx+g9RH22z3

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

rundll32.exe

pid process

1212 rundll32.exe
Loads dropped DLL 5 IoCs

Processes:

fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exerundll32.exe

pid process

1416 fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe
1212 rundll32.exe
1212 rundll32.exe
1212 rundll32.exe
1212 rundll32.exe

pid	process
1212	rundll32.exe

pid	process
1416	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\witile = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\witile.dll\",SetPCDResolution"	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe

pid process

1416 fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe

pid	process
1416	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe

description	pid	process	target process
PID 1416 wrote to memory of 1212	1416	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	rundll32.exe
PID 1416 wrote to memory of 1212	1416	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	rundll32.exe
PID 1416 wrote to memory of 1212	1416	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	rundll32.exe
PID 1416 wrote to memory of 1212	1416	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	rundll32.exe
PID 1416 wrote to memory of 1212	1416	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	rundll32.exe
PID 1416 wrote to memory of 1212	1416	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	rundll32.exe
PID 1416 wrote to memory of 1212	1416	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe
"C:\Users\Admin\AppData\Local\Temp\fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\witile.dll",WriteFileStamp
2⤵
- Deletes itself
- Loads dropped DLL
PID:1212

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\witile.dll
Filesize
117KB

MD5
b2a534b8548c6b7440b18f8c9dd3b8fd

SHA1
231b75cb7d9573b62fb4069e4b0de98b21c5ea2f

SHA256
0ed1a0b8bff3ec8af46829cb095ed2188d4039a7fd5d1c899128ebc74bed561e

SHA512
e357329c3c344e85fe0ef59d6c40d3fe53b82c1b3cbefd8a104e9e477a4c9b718e382630c3dc3f56e8e56cfd96a59c08421ceffead35324808dac048ae97f3d3

Download Submit
\Users\Admin\AppData\Local\Temp\witile.dll
Filesize
117KB

MD5
b2a534b8548c6b7440b18f8c9dd3b8fd

SHA1
231b75cb7d9573b62fb4069e4b0de98b21c5ea2f

SHA256
0ed1a0b8bff3ec8af46829cb095ed2188d4039a7fd5d1c899128ebc74bed561e

SHA512
e357329c3c344e85fe0ef59d6c40d3fe53b82c1b3cbefd8a104e9e477a4c9b718e382630c3dc3f56e8e56cfd96a59c08421ceffead35324808dac048ae97f3d3

Download Submit
\Users\Admin\AppData\Local\Temp\witile.dll
Filesize
117KB

MD5
b2a534b8548c6b7440b18f8c9dd3b8fd

SHA1
231b75cb7d9573b62fb4069e4b0de98b21c5ea2f

SHA256
0ed1a0b8bff3ec8af46829cb095ed2188d4039a7fd5d1c899128ebc74bed561e

SHA512
e357329c3c344e85fe0ef59d6c40d3fe53b82c1b3cbefd8a104e9e477a4c9b718e382630c3dc3f56e8e56cfd96a59c08421ceffead35324808dac048ae97f3d3

Download Submit
\Users\Admin\AppData\Local\Temp\witile.dll
Filesize
117KB

MD5
b2a534b8548c6b7440b18f8c9dd3b8fd

SHA1
231b75cb7d9573b62fb4069e4b0de98b21c5ea2f

SHA256
0ed1a0b8bff3ec8af46829cb095ed2188d4039a7fd5d1c899128ebc74bed561e

SHA512
e357329c3c344e85fe0ef59d6c40d3fe53b82c1b3cbefd8a104e9e477a4c9b718e382630c3dc3f56e8e56cfd96a59c08421ceffead35324808dac048ae97f3d3

Download Submit
\Users\Admin\AppData\Local\Temp\witile.dll
Filesize
117KB

MD5
b2a534b8548c6b7440b18f8c9dd3b8fd

SHA1
231b75cb7d9573b62fb4069e4b0de98b21c5ea2f

SHA256
0ed1a0b8bff3ec8af46829cb095ed2188d4039a7fd5d1c899128ebc74bed561e

SHA512
e357329c3c344e85fe0ef59d6c40d3fe53b82c1b3cbefd8a104e9e477a4c9b718e382630c3dc3f56e8e56cfd96a59c08421ceffead35324808dac048ae97f3d3

Download Submit
\Users\Admin\AppData\Local\Temp\witile.dll
Filesize
117KB

MD5
b2a534b8548c6b7440b18f8c9dd3b8fd

SHA1
231b75cb7d9573b62fb4069e4b0de98b21c5ea2f

SHA256
0ed1a0b8bff3ec8af46829cb095ed2188d4039a7fd5d1c899128ebc74bed561e

SHA512
e357329c3c344e85fe0ef59d6c40d3fe53b82c1b3cbefd8a104e9e477a4c9b718e382630c3dc3f56e8e56cfd96a59c08421ceffead35324808dac048ae97f3d3

Download Submit
memory/1212-84-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download
memory/1212-83-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download
memory/1212-82-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1212-78-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download
memory/1212-70-0x0000000000000000-mapping.dmp

Download
memory/1416-68-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download
memory/1416-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1416-55-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download
memory/1416-56-0x0000000000240000-0x0000000000260000-memory.dmp

Filesize
128KB

Download
memory/1416-69-0x0000000000260000-0x000000000026F000-memory.dmp

Filesize
60KB

Download
memory/1416-60-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1416-67-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/1416-63-0x0000000000280000-0x00000000002A0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing