e43ccac45e02c58d44c1a33d5f00e3bb7f5c09ed795bd5b1c49fad31dd87d39d

Analysis

max time kernel
25s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e43ccac45e02c58d44c1a33d5f00e3bb7f5c09ed795bd5b1c49fad31dd87d39d.dll
Size

778KB
MD5

3974164c07298d7dd19484092c261aa9
SHA1

a759c23af5c9fe9b6e9cf1ba79ddf0ae58078622
SHA256

e43ccac45e02c58d44c1a33d5f00e3bb7f5c09ed795bd5b1c49fad31dd87d39d
SHA512

7ce7e147b38fe9f20c0b5c3da28a1de3fcbb79b64b4ba92fefb8e73c25e437decbaa8ed5b88120500ef0f6e1d3d2507c05cadb54fcb1d1baba40d5a5ddc53a1e
SSDEEP

24576:4zb1MlCKUQyUmjtczu6Prs9pgWoopooK9kwPMLt8F:4zbKsUmjtcdPGgIwPMLyF

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1056	rundll32mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2020	rundll32.exe
2020	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1056	rundll32mgr.exe

Suspicious behavior: MapViewOfSection 24 IoCs

pid	Process
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe
1056	rundll32mgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	rundll32mgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2020	1736	rundll32.exe	28
PID 1736 wrote to memory of 2020	1736	rundll32.exe	28
PID 1736 wrote to memory of 2020	1736	rundll32.exe	28
PID 1736 wrote to memory of 2020	1736	rundll32.exe	28
PID 1736 wrote to memory of 2020	1736	rundll32.exe	28
PID 1736 wrote to memory of 2020	1736	rundll32.exe	28
PID 1736 wrote to memory of 2020	1736	rundll32.exe	28
PID 2020 wrote to memory of 1056	2020	rundll32.exe	29
PID 2020 wrote to memory of 1056	2020	rundll32.exe	29
PID 2020 wrote to memory of 1056	2020	rundll32.exe	29
PID 2020 wrote to memory of 1056	2020	rundll32.exe	29
PID 1056 wrote to memory of 368	1056	rundll32mgr.exe	5
PID 1056 wrote to memory of 368	1056	rundll32mgr.exe	5
PID 1056 wrote to memory of 368	1056	rundll32mgr.exe	5
PID 1056 wrote to memory of 368	1056	rundll32mgr.exe	5
PID 1056 wrote to memory of 368	1056	rundll32mgr.exe	5
PID 1056 wrote to memory of 368	1056	rundll32mgr.exe	5
PID 1056 wrote to memory of 368	1056	rundll32mgr.exe	5
PID 1056 wrote to memory of 380	1056	rundll32mgr.exe	4
PID 1056 wrote to memory of 380	1056	rundll32mgr.exe	4
PID 1056 wrote to memory of 380	1056	rundll32mgr.exe	4
PID 1056 wrote to memory of 380	1056	rundll32mgr.exe	4
PID 1056 wrote to memory of 380	1056	rundll32mgr.exe	4
PID 1056 wrote to memory of 380	1056	rundll32mgr.exe	4
PID 1056 wrote to memory of 380	1056	rundll32mgr.exe	4
PID 1056 wrote to memory of 416	1056	rundll32mgr.exe	3
PID 1056 wrote to memory of 416	1056	rundll32mgr.exe	3
PID 1056 wrote to memory of 416	1056	rundll32mgr.exe	3
PID 1056 wrote to memory of 416	1056	rundll32mgr.exe	3
PID 1056 wrote to memory of 416	1056	rundll32mgr.exe	3
PID 1056 wrote to memory of 416	1056	rundll32mgr.exe	3
PID 1056 wrote to memory of 416	1056	rundll32mgr.exe	3
PID 1056 wrote to memory of 464	1056	rundll32mgr.exe	2
PID 1056 wrote to memory of 464	1056	rundll32mgr.exe	2
PID 1056 wrote to memory of 464	1056	rundll32mgr.exe	2
PID 1056 wrote to memory of 464	1056	rundll32mgr.exe	2
PID 1056 wrote to memory of 464	1056	rundll32mgr.exe	2
PID 1056 wrote to memory of 464	1056	rundll32mgr.exe	2
PID 1056 wrote to memory of 464	1056	rundll32mgr.exe	2
PID 1056 wrote to memory of 472	1056	rundll32mgr.exe	1
PID 1056 wrote to memory of 472	1056	rundll32mgr.exe	1
PID 1056 wrote to memory of 472	1056	rundll32mgr.exe	1
PID 1056 wrote to memory of 472	1056	rundll32mgr.exe	1
PID 1056 wrote to memory of 472	1056	rundll32mgr.exe	1
PID 1056 wrote to memory of 472	1056	rundll32mgr.exe	1
PID 1056 wrote to memory of 472	1056	rundll32mgr.exe	1
PID 1056 wrote to memory of 480	1056	rundll32mgr.exe	26
PID 1056 wrote to memory of 480	1056	rundll32mgr.exe	26
PID 1056 wrote to memory of 480	1056	rundll32mgr.exe	26
PID 1056 wrote to memory of 480	1056	rundll32mgr.exe	26
PID 1056 wrote to memory of 480	1056	rundll32mgr.exe	26
PID 1056 wrote to memory of 480	1056	rundll32mgr.exe	26
PID 1056 wrote to memory of 480	1056	rundll32mgr.exe	26
PID 1056 wrote to memory of 588	1056	rundll32mgr.exe	25
PID 1056 wrote to memory of 588	1056	rundll32mgr.exe	25
PID 1056 wrote to memory of 588	1056	rundll32mgr.exe	25
PID 1056 wrote to memory of 588	1056	rundll32mgr.exe	25
PID 1056 wrote to memory of 588	1056	rundll32mgr.exe	25
PID 1056 wrote to memory of 588	1056	rundll32mgr.exe	25
PID 1056 wrote to memory of 588	1056	rundll32mgr.exe	25
PID 1056 wrote to memory of 668	1056	rundll32mgr.exe	8
PID 1056 wrote to memory of 668	1056	rundll32mgr.exe	8
PID 1056 wrote to memory of 668	1056	rundll32mgr.exe	8
PID 1056 wrote to memory of 668	1056	rundll32mgr.exe	8

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:472

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:876
- - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    PID:1704
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1036
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1216
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:908
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1008
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:108
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:832
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:800
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:752
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:588

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:480

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1972

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e43ccac45e02c58d44c1a33d5f00e3bb7f5c09ed795bd5b1c49fad31dd87d39d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e43ccac45e02c58d44c1a33d5f00e3bb7f5c09ed795bd5b1c49fad31dd87d39d.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1056

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
119KB

MD5
a979c6f227dcaa8187b48c02ce255991

SHA1
5a85d6cd0df89994e4e9ba5408f58edaeec0b659

SHA256
91743a063518b5311e010124fc67e70907878458a393c48bfa9f56fdbe2edc6c

SHA512
c4756abc9c40ee64898bed5e979a7cc91d01d0d574d57051153eab29b03143c63feeeb373794d01ad17810b52f937162dc266f0b4c31cd6dbfed541e1fd4299f

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
119KB

MD5
a979c6f227dcaa8187b48c02ce255991

SHA1
5a85d6cd0df89994e4e9ba5408f58edaeec0b659

SHA256
91743a063518b5311e010124fc67e70907878458a393c48bfa9f56fdbe2edc6c

SHA512
c4756abc9c40ee64898bed5e979a7cc91d01d0d574d57051153eab29b03143c63feeeb373794d01ad17810b52f937162dc266f0b4c31cd6dbfed541e1fd4299f

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
119KB

MD5
a979c6f227dcaa8187b48c02ce255991

SHA1
5a85d6cd0df89994e4e9ba5408f58edaeec0b659

SHA256
91743a063518b5311e010124fc67e70907878458a393c48bfa9f56fdbe2edc6c

SHA512
c4756abc9c40ee64898bed5e979a7cc91d01d0d574d57051153eab29b03143c63feeeb373794d01ad17810b52f937162dc266f0b4c31cd6dbfed541e1fd4299f

Download Submit
memory/1056-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2020-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/2020-61-0x0000000005000000-0x00000000050C8000-memory.dmp

Filesize
800KB

Download
memory/2020-62-0x0000000000130000-0x0000000000159000-memory.dmp

Filesize
164KB

Download
memory/2020-63-0x0000000000130000-0x0000000000159000-memory.dmp

Filesize
164KB

Download
memory/2020-64-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/2020-65-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download