Analysis
-
max time kernel
30s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-03-2023 22:16
Static task
static1
Behavioral task
behavioral1
Sample
df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll
Resource
win10v2004-20230220-en
General
-
Target
df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll
-
Size
5.6MB
-
MD5
20d3f1c59e49b7fbc2524f0d6e1e15ea
-
SHA1
19f89f268c1ca9c73ad076964a62bcabace70b6a
-
SHA256
df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3
-
SHA512
c2478cbe6f463a0a831dfb0ec075aece87a6e355657fccd45ebdcfeb727c03357a495f0374e910965eb76df2253455866b75c227ed2252f775a92faae256d272
-
SSDEEP
98304:fBHB2pne7a1mN1E8lkcf5YjovKqGYiOE8oLj5jIrHL3GqHqUiqaAK8L4:fv1GGE5gyjovK65E8oqjLP3faL
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 3 828 rundll32.exe 7 828 rundll32.exe 8 828 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exepid process 828 rundll32.exe 828 rundll32.exe 828 rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1388 wrote to memory of 828 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 828 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 828 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 828 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 828 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 828 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 828 1388 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll,#12⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base.dllFilesize
862KB
MD5ab00bed7cb2b7a8290e247fc34aaa5ff
SHA1d6014e2920d9b587a8e12ae1ba0f1e1fc9edffa8
SHA256ceffaedc050688e8dcc11ec30b703c63fefbfcf479558604fdb0ea42bcb497c0
SHA512fbe3bf5e142d689bb15d05503fcf5c807aad5bcb99a02dc99590589ee66f7942a0d8365d470041972212dbdf9c232ab4bbab25e79d7bcd43f001a95d9012cca6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4D33E1QE\mgame[1].txtFilesize
2B
MD5444bcb3a3fcf8389296c49467f27e1d6
SHA17a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
SHA2562689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
SHA5129fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570
-
C:\Users\Admin\AppData\Local\Temp\{17B52FA1-7E08-4755-A964-E42876CE1234}.tmp\360NetUL.dllFilesize
234KB
MD5cd03029957ebc78c0ca7a6c02a9ca846
SHA10044114b8073781479044f0294701be9611be2ac
SHA256139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048
SHA51214c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32
-
C:\Users\Admin\AppData\Local\Temp\{17B52FA1-7E08-4755-A964-E42876CE1234}.tmp\NetBridge.dllFilesize
238KB
MD58786d469338c30e0ba9fedfc62bd5197
SHA15fb12028ceae9772f938e1b98b699f0e02e32718
SHA256beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f
SHA5125db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c
-
C:\Users\Admin\AppData\Local\Temp\{17B52FA1-7E08-4755-A964-E42876CE1234}.tmp\Utils\LDSBasic.dllFilesize
2.1MB
MD56747848a45de0eaa7e3dbc339a4d11ff
SHA1698b763d9b6530cbef35f2c4f6240ab51f98879b
SHA2568b060c0575bcf7b466166d8397c65c5be150c21cce32a680c448c3605f524eb1
SHA5123fb05eb464a5b3a6e1d6b0c40d96fc55c6fcd9c6e4eeafe9a3911530b55491a1bb0d4821fbbe2b25c9fe0baef8f208ad307b530ff73f86351fb1e3e6c2c3acbe
-
\Users\Admin\AppData\Local\Temp\{17B52FA1-7E08-4755-A964-E42876CE1234}.tmp\360NetUL.dllFilesize
234KB
MD5cd03029957ebc78c0ca7a6c02a9ca846
SHA10044114b8073781479044f0294701be9611be2ac
SHA256139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048
SHA51214c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32
-
\Users\Admin\AppData\Local\Temp\{17B52FA1-7E08-4755-A964-E42876CE1234}.tmp\Utils\LDSBasic.dllFilesize
2.1MB
MD56747848a45de0eaa7e3dbc339a4d11ff
SHA1698b763d9b6530cbef35f2c4f6240ab51f98879b
SHA2568b060c0575bcf7b466166d8397c65c5be150c21cce32a680c448c3605f524eb1
SHA5123fb05eb464a5b3a6e1d6b0c40d96fc55c6fcd9c6e4eeafe9a3911530b55491a1bb0d4821fbbe2b25c9fe0baef8f208ad307b530ff73f86351fb1e3e6c2c3acbe
-
\Users\Admin\AppData\Local\Temp\{4D00F39E-0512-484a-BE7E-5E3959CE0AB5}.tmp\7z.dllFilesize
1.1MB
MD5a46135bdd574092d85955070e72d5aad
SHA1aad137b0a883fea22b7118778512ffc7865513bc
SHA256aa57160684feb240a85da677caaf7cf6a08b7349d89ae9cb4a3476884d80aac5
SHA51272188f348d9ae33e2b5a7886c80667cc3015bfac170249537baa9e31abf8d63ca198903206feb64887f1d509a1b9bfc9f54ede8b3aa26bee3f5c4375e5c6a24b
-
memory/828-101-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB