c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4

Analysis

max time kernel
202s
max time network
177s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe
Size

108KB
MD5

cae5904d74215ed4e926fe5937f107c5
SHA1

3a660c16691e1bec3d368d9abddaf7dd41877eb8
SHA256

c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4
SHA512

37b3f8178626a3a38173a8db969703d9937a83c1bd010352d961116b485162ee11289941b83d51da497ad624d8d423d5b1e6903eb718e58317033c7a15a8c3fc
SSDEEP

3072:wp/CIHN+HR4SLPflnh3U0qkgszNFJl0nBSkrSZO6:E/xHN+x4SLPflhERkg4NOkYSA

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe
1424	rundll32.exe
1424	rundll32.exe
1424	rundll32.exe
1424	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dyojahazu = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Sewmdon.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1704	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe
1196	rundll32.exe
1424	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1196	1704	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	28
PID 1704 wrote to memory of 1196	1704	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	28
PID 1704 wrote to memory of 1196	1704	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	28
PID 1704 wrote to memory of 1196	1704	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	28
PID 1704 wrote to memory of 1196	1704	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	28
PID 1704 wrote to memory of 1196	1704	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	28
PID 1704 wrote to memory of 1196	1704	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	28
PID 1196 wrote to memory of 1424	1196	rundll32.exe	29
PID 1196 wrote to memory of 1424	1196	rundll32.exe	29
PID 1196 wrote to memory of 1424	1196	rundll32.exe	29
PID 1196 wrote to memory of 1424	1196	rundll32.exe	29
PID 1196 wrote to memory of 1424	1196	rundll32.exe	29
PID 1196 wrote to memory of 1424	1196	rundll32.exe	29
PID 1196 wrote to memory of 1424	1196	rundll32.exe	29

C:\Users\Admin\AppData\Local\Temp\c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe
"C:\Users\Admin\AppData\Local\Temp\c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Sewmdon.dll",Startup
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Sewmdon.dll",iep
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Sewmdon.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
\Users\Admin\AppData\Local\Sewmdon.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
\Users\Admin\AppData\Local\Sewmdon.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
\Users\Admin\AppData\Local\Sewmdon.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
\Users\Admin\AppData\Local\Sewmdon.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
\Users\Admin\AppData\Local\Sewmdon.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
\Users\Admin\AppData\Local\Sewmdon.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
\Users\Admin\AppData\Local\Sewmdon.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
\Users\Admin\AppData\Local\Sewmdon.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
memory/1196-64-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/1196-65-0x0000000002021000-0x000000000202E000-memory.dmp

Filesize
52KB

Download
memory/1424-73-0x0000000001F01000-0x0000000001F0E000-memory.dmp

Filesize
52KB

Download
memory/1704-56-0x0000000000341000-0x000000000034E000-memory.dmp

Filesize
52KB

Download
memory/1704-55-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/1704-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download