Analysis
-
max time kernel
31s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-03-2023 10:08
Static task
static1
Behavioral task
behavioral1
Sample
ecb7addda3c8aa314703c7f0270e33adf16908236eb22f57e290fc5e5cad8371.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ecb7addda3c8aa314703c7f0270e33adf16908236eb22f57e290fc5e5cad8371.dll
Resource
win10v2004-20230220-en
General
-
Target
ecb7addda3c8aa314703c7f0270e33adf16908236eb22f57e290fc5e5cad8371.dll
-
Size
4.0MB
-
MD5
f35e56145d1fae7380b41840e9da7a06
-
SHA1
a47056baee5ffab514e1e0bd9dac9dad7e52fa77
-
SHA256
ecb7addda3c8aa314703c7f0270e33adf16908236eb22f57e290fc5e5cad8371
-
SHA512
c8984e6aadd338c67d4323a15460ada8aa41be57007829cfd5269e43881a3a8412026ec84491512fb675954bd137a908188ddb0062a41f982017fed4466311e5
-
SSDEEP
98304:fBHB2pne7a1mN1E8lkcf5YjovKqGYiOE8oLj5jIJ:fv1GGE5gyjovK65E8oqJ
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 3 2004 rundll32.exe 6 2004 rundll32.exe 8 2004 rundll32.exe 9 2004 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exepid process 2004 rundll32.exe 2004 rundll32.exe 2004 rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb7addda3c8aa314703c7f0270e33adf16908236eb22f57e290fc5e5cad8371.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb7addda3c8aa314703c7f0270e33adf16908236eb22f57e290fc5e5cad8371.dll,#12⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base.dllFilesize
862KB
MD5ab00bed7cb2b7a8290e247fc34aaa5ff
SHA1d6014e2920d9b587a8e12ae1ba0f1e1fc9edffa8
SHA256ceffaedc050688e8dcc11ec30b703c63fefbfcf479558604fdb0ea42bcb497c0
SHA512fbe3bf5e142d689bb15d05503fcf5c807aad5bcb99a02dc99590589ee66f7942a0d8365d470041972212dbdf9c232ab4bbab25e79d7bcd43f001a95d9012cca6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYXN1WWD\mgame[1].txtFilesize
2B
MD5444bcb3a3fcf8389296c49467f27e1d6
SHA17a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
SHA2562689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
SHA5129fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570
-
C:\Users\Admin\AppData\Local\Temp\{A82E195F-B3BB-4b46-BDBC-1431BB997D94}.tmp\360NetUL.dllFilesize
234KB
MD5cd03029957ebc78c0ca7a6c02a9ca846
SHA10044114b8073781479044f0294701be9611be2ac
SHA256139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048
SHA51214c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32
-
C:\Users\Admin\AppData\Local\Temp\{A82E195F-B3BB-4b46-BDBC-1431BB997D94}.tmp\NetBridge.dllFilesize
238KB
MD58786d469338c30e0ba9fedfc62bd5197
SHA15fb12028ceae9772f938e1b98b699f0e02e32718
SHA256beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f
SHA5125db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c
-
C:\Users\Admin\AppData\Local\Temp\{A82E195F-B3BB-4b46-BDBC-1431BB997D94}.tmp\Utils\LDSBasic.dllFilesize
2.1MB
MD56747848a45de0eaa7e3dbc339a4d11ff
SHA1698b763d9b6530cbef35f2c4f6240ab51f98879b
SHA2568b060c0575bcf7b466166d8397c65c5be150c21cce32a680c448c3605f524eb1
SHA5123fb05eb464a5b3a6e1d6b0c40d96fc55c6fcd9c6e4eeafe9a3911530b55491a1bb0d4821fbbe2b25c9fe0baef8f208ad307b530ff73f86351fb1e3e6c2c3acbe
-
\Users\Admin\AppData\Local\Temp\{4045353C-0EB5-458d-B4F3-58E764FCAE7E}.tmp\7z.dllFilesize
1.1MB
MD5a46135bdd574092d85955070e72d5aad
SHA1aad137b0a883fea22b7118778512ffc7865513bc
SHA256aa57160684feb240a85da677caaf7cf6a08b7349d89ae9cb4a3476884d80aac5
SHA51272188f348d9ae33e2b5a7886c80667cc3015bfac170249537baa9e31abf8d63ca198903206feb64887f1d509a1b9bfc9f54ede8b3aa26bee3f5c4375e5c6a24b
-
\Users\Admin\AppData\Local\Temp\{A82E195F-B3BB-4b46-BDBC-1431BB997D94}.tmp\360NetUL.dllFilesize
234KB
MD5cd03029957ebc78c0ca7a6c02a9ca846
SHA10044114b8073781479044f0294701be9611be2ac
SHA256139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048
SHA51214c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32
-
\Users\Admin\AppData\Local\Temp\{A82E195F-B3BB-4b46-BDBC-1431BB997D94}.tmp\Utils\LDSBasic.dllFilesize
2.1MB
MD56747848a45de0eaa7e3dbc339a4d11ff
SHA1698b763d9b6530cbef35f2c4f6240ab51f98879b
SHA2568b060c0575bcf7b466166d8397c65c5be150c21cce32a680c448c3605f524eb1
SHA5123fb05eb464a5b3a6e1d6b0c40d96fc55c6fcd9c6e4eeafe9a3911530b55491a1bb0d4821fbbe2b25c9fe0baef8f208ad307b530ff73f86351fb1e3e6c2c3acbe
-
memory/2004-105-0x0000000001FE0000-0x0000000001FE1000-memory.dmpFilesize
4KB