Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2023 10:56
Static task
static1
Behavioral task
behavioral1
Sample
17112023_2229_Anesthesiology.dll
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
17112023_2229_Anesthesiology.dll
Resource
win10v2004-20231025-en
Behavioral task
behavioral3
Sample
launcher.bat
Resource
win7-20231023-en
General
-
Target
launcher.bat
-
Size
62B
-
MD5
ca26c2116e48ff8168a0dfea335e0ba7
-
SHA1
ad430bfff4a4b47bc7b62786bf117fa8e26440f9
-
SHA256
acc454e4126e9809f4e44f13bf28eaeb20deab377182b579a11fcfbc480da50a
-
SHA512
dae2de54f44777203714deecf057a79ce1e24b446985bea7126f8bc020b64b5c8e17df6a8c27502081b21ee93a4ed9eef05103f73260390de7756b7a6eab7fab
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 4860 set thread context of 3568 4860 rundll32.exe SearchProtocolHost.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 4944 ipconfig.exe 2996 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SearchProtocolHost.exepid process 3568 SearchProtocolHost.exe 3568 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 4860 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
whoami.exenetstat.exedescription pid process Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 3456 whoami.exe Token: SeDebugPrivilege 2996 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 3088 wrote to memory of 1000 3088 cmd.exe rundll32.exe PID 3088 wrote to memory of 1000 3088 cmd.exe rundll32.exe PID 1000 wrote to memory of 4860 1000 rundll32.exe rundll32.exe PID 1000 wrote to memory of 4860 1000 rundll32.exe rundll32.exe PID 1000 wrote to memory of 4860 1000 rundll32.exe rundll32.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe PID 4860 wrote to memory of 3568 4860 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\system32\rundll32.exerundll32.exe 17112023_2229_Anesthesiology.dll,Throw2⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe 17112023_2229_Anesthesiology.dll,Throw3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3568 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all5⤵
- Gathers network information
PID:4944
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
-
-