Analysis
-
max time kernel
141s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2023 13:17
Behavioral task
behavioral1
Sample
765061-creddll.dll
Resource
win7-20230621-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
765061-creddll.dll
Resource
win10v2004-20230621-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
765061-creddll.dll
-
Size
126KB
-
MD5
2930d1a61c3e082b983802bf71266ec0
-
SHA1
9b676931a59da39eac50a08c15d5c4beb22ac366
-
SHA256
5554595940945dc2e7549d8840344e150954f6419b0e809e1bcfb667fcd663f3
-
SHA512
df8038ac7866a9929d56f138380ec75b78723a5a99ce425f394b216f8a30597a90e6f1173269dda06b3a414b0ccab60a6cf1fef2d0047f5ed010d5c7f9aed53b
-
SSDEEP
3072:Yx7p5EJTJx+Rg/TwY1o9CeQepHOSNGwbQ6kUzlCN9V0869:Yx781URg/eCeZfIUzlC
Score
7/10
Malware Config
Signatures
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2684 wrote to memory of 2484 2684 rundll32.exe rundll32.exe PID 2684 wrote to memory of 2484 2684 rundll32.exe rundll32.exe PID 2684 wrote to memory of 2484 2684 rundll32.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\765061-creddll.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\765061-creddll.dll,#12⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:2484