Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 11:18
Static task
static1
Behavioral task
behavioral1
Sample
59af4ef321cdb5782346f2edf76acbc42687090357f6fe3c20bb781c47e5b1ce.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
59af4ef321cdb5782346f2edf76acbc42687090357f6fe3c20bb781c47e5b1ce.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
59af4ef321cdb5782346f2edf76acbc42687090357f6fe3c20bb781c47e5b1ce.dll
-
Size
8.9MB
-
MD5
1c683ce3b97ea290c65b30d18752e9a4
-
SHA1
70c1c7a92f10231d8011c4e81bc0c80cf8136844
-
SHA256
59af4ef321cdb5782346f2edf76acbc42687090357f6fe3c20bb781c47e5b1ce
-
SHA512
58245e3df8d174a4b298f58752d8757a0e333df6218db8e8fc08dfcba8da4d2074de6709057beb9e9fb7e5a2b6c29607a7006332ae34b4434568e51cf79550cd
-
SSDEEP
3072:Oa01JAbL1FjvSqXN2d1GJTh0dRMLFnWV+qY2pH8cR6Xm/S3RBatLG9NOtDDDDDDJ:OaOib9c5RMpohpczXm/QRBvNa
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1676 rundll32.exe Token: SeRestorePrivilege 1676 rundll32.exe Token: SeBackupPrivilege 1676 rundll32.exe Token: SeRestorePrivilege 1676 rundll32.exe Token: SeBackupPrivilege 1676 rundll32.exe Token: SeRestorePrivilege 1676 rundll32.exe Token: SeBackupPrivilege 1676 rundll32.exe Token: SeRestorePrivilege 1676 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1676 1092 rundll32.exe 27 PID 1092 wrote to memory of 1676 1092 rundll32.exe 27 PID 1092 wrote to memory of 1676 1092 rundll32.exe 27 PID 1092 wrote to memory of 1676 1092 rundll32.exe 27 PID 1092 wrote to memory of 1676 1092 rundll32.exe 27 PID 1092 wrote to memory of 1676 1092 rundll32.exe 27 PID 1092 wrote to memory of 1676 1092 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59af4ef321cdb5782346f2edf76acbc42687090357f6fe3c20bb781c47e5b1ce.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59af4ef321cdb5782346f2edf76acbc42687090357f6fe3c20bb781c47e5b1ce.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k sougou1⤵
- Suspicious behavior: EnumeratesProcesses
PID:304
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28.2MB
MD5a81070a7c2a84adca1d9026ce64ac7d5
SHA11120f2c86c56df4311dd71fc7ffc82bb75da59c6
SHA256bcd659af6cbae5c460a60f58fa8c8b907b0e99071046bafc3934d9e1d67d73a6
SHA512fd5b71dff8d76985e6f3ff831f7e7d2cdce67fd49509d9c430f6468e8e6336b40832be9a51b54b58544fb10b91a72305a5a9e2bbedc20c2bb73a626fd873e7ea
