44eb4a583b8893724edfd5783a3698361e3c4fc8cfdac2d0f198be7d9f537c23

Analysis

max time kernel
143s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44eb4a583b8893724edfd5783a3698361e3c4fc8cfdac2d0f198be7d9f537c23.dll
Size

2.6MB
MD5

23eebbd675a990094b1efbbf8992ac91
SHA1

a7514a3338056597e642adfb9cd4c90d1227eb1c
SHA256

44eb4a583b8893724edfd5783a3698361e3c4fc8cfdac2d0f198be7d9f537c23
SHA512

937e8c1589f01424be96d773215d290d2a5c74090c2cff795bfbda7b225e50d3c39c11c332c89f4ab031067f4a9492e6e6cd58d5122adb126f162427d631a4a0
SSDEEP

49152:jMb9OOwITK1skh5vPlfjIOvXXQ0sEpXhEQTZ1lsc07PDWF4xvjDYaR6NiBZ+T9al:YR5AsYNlfjdA0v2imPYmSiBZmi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1696	9231.tmp

Loads dropped DLL 2 IoCs

pid	Process
1548	rundll32.exe
1548	rundll32.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXEV.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee.dll	9231.tmp
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSF.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1CORE.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSLID.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\INTLDATE.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	9231.tmp
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia100.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NL7Data0011.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\USP10.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNoteSyncPC.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL	9231.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FDATE.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSRTEDIT.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IMCONTACT.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IETAG.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHEV.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OLMAPI32.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\VBAJET32.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MOFL.DLL	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE	9231.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll	9231.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll	9231.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL	9231.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	9231.tmp

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1548	2124	rundll32.exe	28
PID 2124 wrote to memory of 1548	2124	rundll32.exe	28
PID 2124 wrote to memory of 1548	2124	rundll32.exe	28
PID 2124 wrote to memory of 1548	2124	rundll32.exe	28
PID 2124 wrote to memory of 1548	2124	rundll32.exe	28
PID 2124 wrote to memory of 1548	2124	rundll32.exe	28
PID 2124 wrote to memory of 1548	2124	rundll32.exe	28
PID 1548 wrote to memory of 1696	1548	rundll32.exe	29
PID 1548 wrote to memory of 1696	1548	rundll32.exe	29
PID 1548 wrote to memory of 1696	1548	rundll32.exe	29
PID 1548 wrote to memory of 1696	1548	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44eb4a583b8893724edfd5783a3698361e3c4fc8cfdac2d0f198be7d9f537c23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44eb4a583b8893724edfd5783a3698361e3c4fc8cfdac2d0f198be7d9f537c23.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Users\Admin\AppData\Local\Temp\9231.tmp
    C:\Users\Admin\AppData\Local\Temp\9231.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9231.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\9231.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\9231.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
\Users\Admin\AppData\Local\Temp\9231.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
\Users\Admin\AppData\Local\Temp\9231.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/1548-0-0x0000000001F50000-0x000000000201A000-memory.dmp

Filesize
808KB

Download
memory/1548-1-0x0000000001F50000-0x000000000201A000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads