46eeb436a29d74d779e09058eb574f83903c09c31706791288842640ddd94052

Resubmissions

17/07/2023, 06:47

230717-hkjkpsaf26 10

17/07/2023, 06:25

230717-g6z9xaae78 6

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client.dll
Size

491KB
MD5

998c79456d9782eb1a03140e04f36d46
SHA1

9066be672da3a63b2fd7813e5c5ec1b3d1b36b3d
SHA256

46eeb436a29d74d779e09058eb574f83903c09c31706791288842640ddd94052
SHA512

fd48b4de9c06703bc2c6bcecb421cc77d974aacbaa3a805819616ea7dff43b8cc2b27f9f8ed50ee5a1e93911395ef85536f078927026eecc5651ce7a4070cec8
SSDEEP

3072:qqRbGFyesZPmO4wERAl/PfjDsJGa2Bbt/OF5fx9xmkrSG4uhIAI0YixrrVcR9nFb:qKbuEZD2alrD7a27/efx9FW8Uu6R7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdate	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2624 set thread context of 2064	2624	rundll32.exe	28

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2624	rundll32.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe
2064	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	rundll32.exe
Token: SeDebugPrivilege	2064	wmplayer.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2064	2624	rundll32.exe	28
PID 2624 wrote to memory of 2064	2624	rundll32.exe	28
PID 2624 wrote to memory of 2064	2624	rundll32.exe	28
PID 2624 wrote to memory of 2064	2624	rundll32.exe	28
PID 2624 wrote to memory of 2064	2624	rundll32.exe	28
PID 2624 wrote to memory of 2064	2624	rundll32.exe	28
PID 2624 wrote to memory of 2064	2624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Client.dll,#1
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Client.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-56-0x0000000000130000-0x0000000000161000-memory.dmp

Filesize
196KB

Download
memory/2064-59-0x00000000008E0000-0x0000000000BE3000-memory.dmp

Filesize
3.0MB

Download
memory/2064-60-0x0000000000130000-0x0000000000161000-memory.dmp

Filesize
196KB

Download
memory/2624-55-0x0000000077900000-0x0000000077AA9000-memory.dmp

Filesize
1.7MB

Download
memory/2624-58-0x0000000077900000-0x0000000077AA9000-memory.dmp

Filesize
1.7MB

Download