Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
a7168b052e1aca78b1e5916e55e9bec62ec349209b50fd684629a745b0ef650e.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
a7168b052e1aca78b1e5916e55e9bec62ec349209b50fd684629a745b0ef650e.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
a7168b052e1aca78b1e5916e55e9bec62ec349209b50fd684629a745b0ef650e.dll
-
Size
25KB
-
MD5
c67a682c92d2ece218c771b8f7bf202a
-
SHA1
c9f67e97a73c5f9e52a9fa22ed699fc733bb4da4
-
SHA256
a7168b052e1aca78b1e5916e55e9bec62ec349209b50fd684629a745b0ef650e
-
SHA512
62fb4974c0cf8da7c0dd08881499939d2a84f2295cbe4eed9518312e57a4b1129507cf2498d48ba5de354da8890d6bf0235bdb655daeb54548b6ff8e58c87e20
-
SSDEEP
384:Sc/Rdt4Kfi4nGvAAqeTgEBxwFFxedoA+OO1aAtfmzhzT8ltJQbHNYmsYaYmpAM:S2ZGvAAqeTFBiJedJOIPzhk9sYYHM
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\msvcr.dll rundll32.exe File opened for modification C:\Windows\msvcr.dll rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "a7168b052e1aca78b1e5916e55e9bec62ec349209b50fd684629a745b0ef650e.dll,1285608496,1563368310,-1814625877" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1528 wrote to memory of 1152 1528 rundll32.exe 27 PID 1528 wrote to memory of 1152 1528 rundll32.exe 27 PID 1528 wrote to memory of 1152 1528 rundll32.exe 27 PID 1528 wrote to memory of 1152 1528 rundll32.exe 27 PID 1528 wrote to memory of 1152 1528 rundll32.exe 27 PID 1528 wrote to memory of 1152 1528 rundll32.exe 27 PID 1528 wrote to memory of 1152 1528 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7168b052e1aca78b1e5916e55e9bec62ec349209b50fd684629a745b0ef650e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7168b052e1aca78b1e5916e55e9bec62ec349209b50fd684629a745b0ef650e.dll,#12⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\rundll32.exerundll32 "C:\Windows\msvcr.dll",_RunAs@03⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1152
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5c67a682c92d2ece218c771b8f7bf202a
SHA1c9f67e97a73c5f9e52a9fa22ed699fc733bb4da4
SHA256a7168b052e1aca78b1e5916e55e9bec62ec349209b50fd684629a745b0ef650e
SHA51262fb4974c0cf8da7c0dd08881499939d2a84f2295cbe4eed9518312e57a4b1129507cf2498d48ba5de354da8890d6bf0235bdb655daeb54548b6ff8e58c87e20