719717c01d82b4a4f96057df19b96b409b74ea122a720784407577b2b41876ab

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/10/2023, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3d1ef821849f015365076467994986ebf47905ffcc4f16761d222e1155abd10ba229aa11e70694c70523e9cbfd0eba5.dll
Size

364KB
MD5

264a37b36511c366730fa05b0d4981ff
SHA1

ce2bb3512e614c7b9bef6348aa98a7e59193c759
SHA256

719717c01d82b4a4f96057df19b96b409b74ea122a720784407577b2b41876ab
SHA512

1b1bbab210af682970bcff9d22039fdf6479f2ebad339c2badaee113df02ce3ea25637d9f167fe7effc503195e73524ff91f03a48385cc3b14b28ef4902fae85
SSDEEP

6144:bvRk7oxjteyCowrmMmKJSrwg61KX+u2XY1VtzymngFI/oXy:2mRwlmlr761a2I1VtNngK/oC

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	2240	rundll32.exe
5	2240	rundll32.exe
6	2240	rundll32.exe
8	2240	rundll32.exe
9	2240	rundll32.exe
10	2240	rundll32.exe
11	2240	rundll32.exe
12	2240	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Control Panel\International\Geo\Nation	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ifconfig.me

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3d1ef821849f015365076467994986ebf47905ffcc4f16761d222e1155abd10ba229aa11e70694c70523e9cbfd0eba5.dll,#1
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads