d44245ed1209ecaf8835d0a238d5a7f204ab547b94e673fea346a0ce01832070

General

Target

d44245ed1209ecaf8835d0a238d5a7f204ab547b94e673fea346a0ce01832070.dll
Size

15.8MB
MD5

ec19f589f5152f37f79ddd82ca1f6a9c
SHA1

e2ba9465a0c8494c3538c57221f6debe5a1bfb3c
SHA256

d44245ed1209ecaf8835d0a238d5a7f204ab547b94e673fea346a0ce01832070
SHA512

39ef6b4e4b7f86a5c71b1040ed8da3982e48474bf6779effa4771af4f5bd15ea518e6a194839ab7c4f5dd3d971fbd4c25293e528cb2ed368d81551abbafd88a8
SSDEEP

393216:vt8s1J47iD/YqqEv+qrNZOx6Z0JvKsMumgpuM:18sIQ/YfJcY5KBcuM

Score

10^/10

upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4452 created 632	4452	rundll32.exe	3

Blocklisted process makes network request 1 IoCs

flow	pid	Process
27	4452	rundll32.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4452-1-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-0-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-3-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-7-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-5-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-9-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-2-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-11-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-17-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-19-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-21-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-23-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-15-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-25-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-13-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-27-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-31-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-29-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-33-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-35-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-39-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-41-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-37-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-44-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx
behavioral2/memory/4452-45-0x0000000002F00000-0x0000000002F3E000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4452	rundll32.exe
4452	rundll32.exe
4452	rundll32.exe
4452	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4452	rundll32.exe
Token: SeDebugPrivilege	4452	rundll32.exe
Token: SeDebugPrivilege	4452	rundll32.exe
Token: SeDebugPrivilege	4452	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4452	rundll32.exe
4452	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4452	2220	rundll32.exe	77
PID 2220 wrote to memory of 4452	2220	rundll32.exe	77
PID 2220 wrote to memory of 4452	2220	rundll32.exe	77
PID 4452 wrote to memory of 316	4452	rundll32.exe	89
PID 4452 wrote to memory of 316	4452	rundll32.exe	89
PID 4452 wrote to memory of 316	4452	rundll32.exe	89
PID 4452 wrote to memory of 4272	4452	rundll32.exe	87
PID 4452 wrote to memory of 4272	4452	rundll32.exe	87
PID 4452 wrote to memory of 4272	4452	rundll32.exe	87

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\SysWOW64\rundll32.exe
  2⤵
  PID:4272

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d44245ed1209ecaf8835d0a238d5a7f204ab547b94e673fea346a0ce01832070.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d44245ed1209ecaf8835d0a238d5a7f204ab547b94e673fea346a0ce01832070.dll,#1
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe
    3⤵
    PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4452-1-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-0-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-3-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-7-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-5-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-9-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-2-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-11-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-17-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-19-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-21-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-23-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-15-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-25-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-13-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-27-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-31-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-29-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-33-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-35-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-39-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-41-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-37-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-44-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download
memory/4452-45-0x0000000002F00000-0x0000000002F3E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing