Analysis
- max time kernel
143s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
18/07/2023, 21:01
Behavioral task
behavioral1
Sample
b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3.dll
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3.dll
- Size 335KB
- Sample230718-ztxmcsdh96
- SHA256 b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3
- MD5 a637c909097b250da561b12ae33e7486
- SHA1 f71cc41357814b5c3b132aaaedd6a24ebbd0c102
- SHA512 a02a4244947a3ca24d65a356b8ae405b4620884d033d29570a411c539f6e55eca0c579ab3b61de9a14e4eaec66417e57974ee7b28bb03e2728c359cef3168ce3
- SSDEEP 6144:R1VH+po6EJ5IYW6eBveHVK8PNEt1ZJr0HkT7Npvm7sbnTH7Mx:3d4oR+YImEx/gkThp0wnTHYx
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 7 IoCs
flow pid Process 22 4352 rundll32.exe 30 4352 rundll32.exe 41 4352 rundll32.exe 48 4352 rundll32.exe 67 4352 rundll32.exe 74 4352 rundll32.exe 76 4352 rundll32.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation rundll32.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\NvTmRep_CrashReport4_{ B2FE1952 - 0186 - 46H3 - BAHC - A80AA35AH5B8 }.job rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe 4352 rundll32.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 208 wrote to memory of 4352 208 rundll32.exe 84 PID 208 wrote to memory of 4352 208 rundll32.exe 84 PID 208 wrote to memory of 4352 208 rundll32.exe 84 PID 4352 wrote to memory of 4708 4352 rundll32.exe 93 PID 4352 wrote to memory of 4708 4352 rundll32.exe 93 PID 4352 wrote to memory of 4708 4352 rundll32.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3.dll,#12⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C nltest /domain_trusts > C:\ProgramData\TMPUSER.DAT3⤵PID:4708
-
-