Analysis
-
max time kernel
154s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:18
Static task
static1
Behavioral task
behavioral1
Sample
a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll
Resource
win10v2004-20220812-en
General
-
Target
a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll
-
Size
49KB
-
MD5
67ebe5a7b9951331b7092f8bceb3dd13
-
SHA1
3ef8ded2d6077ef3f55feb8245b4a8cb4e93d7fe
-
SHA256
a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe
-
SHA512
f6607bcd9188e6d8c855aa4b81d1257ee1c5cedcdbd8784c61eb353d4ec3566d2774888f3db17228fbb7f42ad612b59c45ec225357b1ff95c1ab72ee20bb4e21
-
SSDEEP
768:syUqhmQIIsDZgnswpFz9Y18Q4SnAghSBEkzlfjjD2GmCDH3lZ:rUqhmQrepgFxY182h+jyGmM
Malware Config
Signatures
-
Modifies WinLogon 2 TTPs 8 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Shutdown = "WinOff2EX" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Asynchronous = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Impersonate = "0" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\DllName = "mdhcp32.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Startup = "WinStart2EX" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Logoff = "WinOff2EX" rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 916 wrote to memory of 620 916 rundll32.exe rundll32.exe PID 916 wrote to memory of 620 916 rundll32.exe rundll32.exe PID 916 wrote to memory of 620 916 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll,#12⤵
- Modifies WinLogon