Analysis
-
max time kernel
148s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2023 19:31
Behavioral task
behavioral1
Sample
500a341913184039fdefeb694b5f27949c9903bfd63ccbb8b2a8e168c6494efc.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
500a341913184039fdefeb694b5f27949c9903bfd63ccbb8b2a8e168c6494efc.dll
Resource
win10v2004-20230220-en
General
-
Target
500a341913184039fdefeb694b5f27949c9903bfd63ccbb8b2a8e168c6494efc.dll
-
Size
1.7MB
-
MD5
a61aa5b02af7ceb08d25f5f2c8071f73
-
SHA1
29d541f44d25ac1d467447e57595d31490fe7691
-
SHA256
500a341913184039fdefeb694b5f27949c9903bfd63ccbb8b2a8e168c6494efc
-
SHA512
d394899c6cb1f28987712a33bad4b1c50efb4089a1233790018995ddbf531246b3c87fe26a9f80f148a9e831e0e19ab6820f54789dcc79a2f12d70c768a09418
-
SSDEEP
49152:M7yYiFKAtm5I/KKAXIf+h/C/MrxjvTH7Bc:MwFKAYF/ht7H7Bc
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9B657DAC-C805-4B7C-9C55-E4C43024CC27}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{59DB456E-FBDA-483B-BD3C-830DD9C1E3FC}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2060 wrote to memory of 1804 2060 rundll32.exe rundll32.exe PID 2060 wrote to memory of 1804 2060 rundll32.exe rundll32.exe PID 2060 wrote to memory of 1804 2060 rundll32.exe rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\500a341913184039fdefeb694b5f27949c9903bfd63ccbb8b2a8e168c6494efc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\500a341913184039fdefeb694b5f27949c9903bfd63ccbb8b2a8e168c6494efc.dll,#12⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1804-133-0x00000000748B0000-0x0000000074C04000-memory.dmpFilesize
3.3MB
-
memory/1804-135-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/1804-136-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/1804-134-0x00000000025C0000-0x000000000260B000-memory.dmpFilesize
300KB
-
memory/1804-137-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/1804-139-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/1804-138-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/1804-140-0x00000000027A0000-0x00000000027A1000-memory.dmpFilesize
4KB
-
memory/1804-141-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/1804-142-0x0000000002CE0000-0x0000000002CE2000-memory.dmpFilesize
8KB
-
memory/1804-146-0x00000000025C0000-0x000000000260B000-memory.dmpFilesize
300KB