Analysis
-
max time kernel
151s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 16:11
Static task
static1
Behavioral task
behavioral1
Sample
ec021c01776c7e86e836ae56f331b88196a5024589b3a0a811b7c8aebacdc116.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ec021c01776c7e86e836ae56f331b88196a5024589b3a0a811b7c8aebacdc116.dll
Resource
win10v2004-20221111-en
General
-
Target
ec021c01776c7e86e836ae56f331b88196a5024589b3a0a811b7c8aebacdc116.dll
-
Size
1.5MB
-
MD5
849a766ef139b1c82e4cc8541fbb1c1c
-
SHA1
2d3dfa8517778130e507be7b58f1a96ea7c210ad
-
SHA256
ec021c01776c7e86e836ae56f331b88196a5024589b3a0a811b7c8aebacdc116
-
SHA512
c48bc320d04f5daf612784841a8a47cf544555803076d8933340636b986ec6babf144cc7704e2115b997dc10507eeaf2049239a90ec9b76b8670c90091207b5d
-
SSDEEP
6144:GXkWpMQwzjCZl13fTS5W3tc7T1rdEjVJ3D:GXNMQ1ZDfTS5eccjVBD
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\Windows\\system32\\rundll32.exe C:\\PROGRA~3\\dllfilwinaim.dat,StartAs" regsvr32.exe -
Drops file in Program Files directory 4 IoCs
Processes:
regsvr32.exedescription ioc process File created C:\PROGRA~3\mianiwliflld.dat regsvr32.exe File opened for modification C:\PROGRA~3\mianiwliflld.dat regsvr32.exe File created C:\PROGRA~3\dllfilwinaim.dat regsvr32.exe File opened for modification C:\PROGRA~3\dllfilwinaim.dat regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1468 regsvr32.exe 1468 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
regsvr32.exedescription pid process Token: SeDebugPrivilege 1468 regsvr32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 4444 wrote to memory of 1468 4444 regsvr32.exe regsvr32.exe PID 4444 wrote to memory of 1468 4444 regsvr32.exe regsvr32.exe PID 4444 wrote to memory of 1468 4444 regsvr32.exe regsvr32.exe PID 1468 wrote to memory of 2700 1468 regsvr32.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec021c01776c7e86e836ae56f331b88196a5024589b3a0a811b7c8aebacdc116.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ec021c01776c7e86e836ae56f331b88196a5024589b3a0a811b7c8aebacdc116.dll3⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1468-132-0x0000000000000000-mapping.dmp
-
memory/1468-133-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1468-134-0x0000000002C40000-0x0000000002C6B000-memory.dmpFilesize
172KB
-
memory/1468-135-0x0000000002D10000-0x0000000002D78000-memory.dmpFilesize
416KB
-
memory/1468-136-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB