Analysis
-
max time kernel
185s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:14
Static task
static1
Behavioral task
behavioral1
Sample
f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll
Resource
win10v2004-20221111-en
General
-
Target
f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll
-
Size
738KB
-
MD5
0bfb96723fd4b34049b50d646fa03197
-
SHA1
ea6a64b044487026c3369f3ba522dd670e6d5ee2
-
SHA256
f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd
-
SHA512
30cb58ae6b85e39ac15d0508e6e64332bc606f73e32c9bb3de0d19e6a9f853357160249363b73a457f9dc59b5f074ed878d963f19f5415794c677095baa4a948
-
SSDEEP
12288:MwGsNHl+QXfQrKFAVUBhrTVNXO7H7N7u18rdHQ8aq+DFER:+sNHlNfQrKFEUn9N+bZu18rdHQ8a7DFM
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 37 2616 rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Modifies registry class 3 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ÀĈÀĈ rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ÀĈÀĈ\ = "{DB417A4F-56BD-2362-181B-580006CE1615}" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\ÀĈÀĈ\䅺뷛扖 = "15" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2616 rundll32.exe 2616 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 224 wrote to memory of 2616 224 rundll32.exe rundll32.exe PID 224 wrote to memory of 2616 224 rundll32.exe rundll32.exe PID 224 wrote to memory of 2616 224 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll,#12⤵
- Blocklisted process makes network request
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses