Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 00:55
Behavioral task
behavioral1
Sample
a8b3dadec53c421db3dc4ee596de3971031dbe4b6713605ff97bad2372329adb.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
a8b3dadec53c421db3dc4ee596de3971031dbe4b6713605ff97bad2372329adb.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
a8b3dadec53c421db3dc4ee596de3971031dbe4b6713605ff97bad2372329adb.dll
-
Size
39KB
-
MD5
44f355ce69dc23d196930d199a96e230
-
SHA1
884e761879c4f6c003268f8ab9c79d59e4e19569
-
SHA256
a8b3dadec53c421db3dc4ee596de3971031dbe4b6713605ff97bad2372329adb
-
SHA512
c7330533ab132a81619cf11fe16e611d54d44d5b0031cb58f8bb76fda300093b869d5693375270611e2d223ab936f2a00db35137449787165d4b8bc1a3fe50a0
-
SSDEEP
768:qOQz5gWq/XHlLC4wHu2eCJmfIDF4qGfgt76IZl3MO+/sd6xHSqtEnbcuyD7UB:M5gWEVe4wHu2e85JeIRZl3MOvDqOnouL
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000022e24-134.dat acprotect behavioral2/files/0x0009000000022e24-135.dat acprotect -
resource yara_rule behavioral2/files/0x0009000000022e24-134.dat upx behavioral2/files/0x0009000000022e24-135.dat upx behavioral2/memory/4856-136-0x0000000010000000-0x0000000010023000-memory.dmp upx behavioral2/memory/4544-137-0x0000000010000000-0x0000000010023000-memory.dmp upx behavioral2/memory/4856-138-0x0000000010000000-0x0000000010023000-memory.dmp upx behavioral2/memory/4544-139-0x0000000010000000-0x0000000010023000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 4544 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lua.wkl rundll32.exe File created C:\Windows\misaue.dll rundll32.exe File opened for modification C:\Windows\misaue.dll rundll32.exe File opened for modification C:\Windows\lua.wkl rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "a8b3dadec53c421db3dc4ee596de3971031dbe4b6713605ff97bad2372329adb.dll,1314780942,-1057327870,-352895392" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1268 wrote to memory of 4856 1268 rundll32.exe 81 PID 1268 wrote to memory of 4856 1268 rundll32.exe 81 PID 1268 wrote to memory of 4856 1268 rundll32.exe 81 PID 4856 wrote to memory of 4544 4856 rundll32.exe 82 PID 4856 wrote to memory of 4544 4856 rundll32.exe 82 PID 4856 wrote to memory of 4544 4856 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8b3dadec53c421db3dc4ee596de3971031dbe4b6713605ff97bad2372329adb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8b3dadec53c421db3dc4ee596de3971031dbe4b6713605ff97bad2372329adb.dll,#12⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\rundll32.exerundll32 "C:\Windows\misaue.dll",_RunAs@163⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4544
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD544f355ce69dc23d196930d199a96e230
SHA1884e761879c4f6c003268f8ab9c79d59e4e19569
SHA256a8b3dadec53c421db3dc4ee596de3971031dbe4b6713605ff97bad2372329adb
SHA512c7330533ab132a81619cf11fe16e611d54d44d5b0031cb58f8bb76fda300093b869d5693375270611e2d223ab936f2a00db35137449787165d4b8bc1a3fe50a0
-
Filesize
39KB
MD544f355ce69dc23d196930d199a96e230
SHA1884e761879c4f6c003268f8ab9c79d59e4e19569
SHA256a8b3dadec53c421db3dc4ee596de3971031dbe4b6713605ff97bad2372329adb
SHA512c7330533ab132a81619cf11fe16e611d54d44d5b0031cb58f8bb76fda300093b869d5693375270611e2d223ab936f2a00db35137449787165d4b8bc1a3fe50a0