Analysis
-
max time kernel
131s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 17:33
Static task
static1
Behavioral task
behavioral1
Sample
c5672049d5dde081d1000ce4316e5f77f2db206e552b55b6effe175419ba2b69.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c5672049d5dde081d1000ce4316e5f77f2db206e552b55b6effe175419ba2b69.dll
Resource
win10v2004-20220812-en
General
-
Target
c5672049d5dde081d1000ce4316e5f77f2db206e552b55b6effe175419ba2b69.dll
-
Size
79KB
-
MD5
fcb374582979236759e3b5b3883f9882
-
SHA1
1ed5600375d54473311469dc3a18131999986466
-
SHA256
c5672049d5dde081d1000ce4316e5f77f2db206e552b55b6effe175419ba2b69
-
SHA512
9c3cc33db2394996192f4c9d5983cd307dc61530997f3d34ca52e406c07a70fc666fbbe9212a9b4191df3e0b1adc7176acce51e9346dec32ad4d9a2b14152d89
-
SSDEEP
1536:ehXoJQsd31wnQGQ4zWEuPh1qarIg5UnYNnVUn7Zqj8ZcEVY/5rGcU2+6L:eaJQsBqnQGQXjUaUnYNnV9jO8UWL
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 1840 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4996 wrote to memory of 1840 4996 rundll32.exe rundll32.exe PID 4996 wrote to memory of 1840 4996 rundll32.exe rundll32.exe PID 4996 wrote to memory of 1840 4996 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c5672049d5dde081d1000ce4316e5f77f2db206e552b55b6effe175419ba2b69.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c5672049d5dde081d1000ce4316e5f77f2db206e552b55b6effe175419ba2b69.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1840-132-0x0000000000000000-mapping.dmp
-
memory/1840-133-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/1840-134-0x0000000000530000-0x0000000000535000-memory.dmpFilesize
20KB
-
memory/1840-135-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/1840-136-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB