afefa6927a755e3923bf5411ffbca6d21fadc601cc7674c3b17f1d5aeaf31c7d

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afefa6927a755e3923bf5411ffbca6d21fadc601cc7674c3b17f1d5aeaf31c7d.dll
Size

92KB
MD5

88f0fdad4bd7b9a84cc72bb821c57981
SHA1

95d5faad20e7b31779e89fa9835e6a8f79ce1936
SHA256

afefa6927a755e3923bf5411ffbca6d21fadc601cc7674c3b17f1d5aeaf31c7d
SHA512

250cfe9b1a5197b1ca94243741d3c283f22f76d2f5e4efe33493d452b4c43ee028cd03c09f22cf61c16a248bfa0c9312f3bf106bcf3e2ee2898baa1c6a3bc0f8
SSDEEP

1536:p1ON/fgDpl6NTMApNHtLM4c012fRTMteoZmznD3J:p1OOpKLTo4v1gRTMIkmznDZ

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\BITS\Parameters\ServiceDll = "C:\\Windows\\system32\\qmgr.dll"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\qmgr.dll	rundll32.exe
File created	C:\Windows\SysWOW64\qmgr.dll	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\afefa6927a755e3923bf5411ffbca6d21fadc601cc7674c3b17f1d5aeaf31c7d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\afefa6927a755e3923bf5411ffbca6d21fadc601cc7674c3b17f1d5aeaf31c7d.dll,#1
  2⤵
  - Sets DLL path for service in the registry
  - Drops file in System32 directory
  PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download