Analysis
-
max time kernel
192s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 10:55
Static task
static1
Behavioral task
behavioral1
Sample
f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15.dll
-
Size
68KB
-
MD5
7c0e6313c56b5bc829bc59c4829871c2
-
SHA1
64a27b5e46e4406ef488a23304ceea9a70d833c9
-
SHA256
f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15
-
SHA512
833479990c05344e8d833a9a07ebf5e87a8ccd00e0dae0d86e82f08050fec7190462e654652b8839596f2ce9b9adf918e2c400d2117d86b0d092018e89202fce
-
SSDEEP
768:LtRZ0NkZKDHOZcBHCE2a/ZOh+xqQKzvu+avgKvo9jd9cDgupNNpQcJJ9N0h/f4A/:JR2vOyTb/M+nKzvuIOo1f4
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\64to32\Parameters\ServiceDll = "C:\\Windows\\system32\\64to32.dll" rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 3084 svchost.exe -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.220.220 Destination IP 208.67.220.220 -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Windowsxp32.ini svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 svchost.exe File opened for modification C:\Windows\SysWOW64\Windowsxp.ini svchost.exe File created C:\Windows\SysWOW64\64to32.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\64to32.dll rundll32.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe 3084 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1536 wrote to memory of 3520 1536 rundll32.exe 83 PID 1536 wrote to memory of 3520 1536 rundll32.exe 83 PID 1536 wrote to memory of 3520 1536 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15.dll,#12⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:3520
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3084
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD57c0e6313c56b5bc829bc59c4829871c2
SHA164a27b5e46e4406ef488a23304ceea9a70d833c9
SHA256f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15
SHA512833479990c05344e8d833a9a07ebf5e87a8ccd00e0dae0d86e82f08050fec7190462e654652b8839596f2ce9b9adf918e2c400d2117d86b0d092018e89202fce
-
Filesize
68KB
MD57c0e6313c56b5bc829bc59c4829871c2
SHA164a27b5e46e4406ef488a23304ceea9a70d833c9
SHA256f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15
SHA512833479990c05344e8d833a9a07ebf5e87a8ccd00e0dae0d86e82f08050fec7190462e654652b8839596f2ce9b9adf918e2c400d2117d86b0d092018e89202fce