Resubmissions
05/04/2024, 15:05
240405-sf5bqaff88 1027/11/2023, 17:10
231127-vpqk2aae84 827/11/2023, 16:30
231127-tzsbyahg8y 7Analysis
-
max time kernel
570s -
max time network
576s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2023, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
28112023_0030_version1.zip
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
28112023_0030_version1.zip
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
launcher.bat
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral4
Sample
launcher.bat
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
version1.dll
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral6
Sample
version1.dll
Resource
win10v2004-20231020-en
windows10-2004-x64
General
-
Target
launcher.bat
-
Size
62B
-
MD5
7d6b98d6fea6b32c98e4f6acb8930efe
-
SHA1
cf4689c45b1bd398ce2cf2f5c399c007166de257
-
SHA256
76ce2f0f4ac28eb39f4f06a15defec3b7a2eb4c4a55c05fa86535b1a3cdabc23
-
SHA512
35a9c5517b8e1a97bd02de5088e26050485aacd50783366f3b513b84c0886eff42d19fc8ba5369602755a3e6ed2bb5b02af50cc2f7a1b8406eba21e6f296539c
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 43 2764 rundll32.exe 45 2764 rundll32.exe 46 2764 rundll32.exe 48 2764 rundll32.exe 49 2764 rundll32.exe 50 2764 rundll32.exe 51 2764 rundll32.exe 53 2764 rundll32.exe 54 2764 rundll32.exe 55 2764 rundll32.exe 56 2764 rundll32.exe 57 2764 rundll32.exe 58 2764 rundll32.exe 59 2764 rundll32.exe 60 2764 rundll32.exe 61 2764 rundll32.exe 62 2764 rundll32.exe 63 2764 rundll32.exe 64 2764 rundll32.exe 65 2764 rundll32.exe 66 2764 rundll32.exe 67 2764 rundll32.exe 68 2764 rundll32.exe 69 2764 rundll32.exe 70 2764 rundll32.exe 71 2764 rundll32.exe 72 2764 rundll32.exe 73 2764 rundll32.exe 74 2764 rundll32.exe 75 2764 rundll32.exe 76 2764 rundll32.exe 77 2764 rundll32.exe 78 2764 rundll32.exe 79 2764 rundll32.exe 80 2764 rundll32.exe 81 2764 rundll32.exe 82 2764 rundll32.exe 83 2764 rundll32.exe 84 2764 rundll32.exe 85 2764 rundll32.exe 86 2764 rundll32.exe 87 2764 rundll32.exe 88 2764 rundll32.exe 89 2764 rundll32.exe 90 2764 rundll32.exe 91 2764 rundll32.exe 92 2764 rundll32.exe 93 2764 rundll32.exe 94 2764 rundll32.exe 95 2764 rundll32.exe 96 2764 rundll32.exe 97 2764 rundll32.exe 98 2764 rundll32.exe 99 2764 rundll32.exe 100 2764 rundll32.exe 101 2764 rundll32.exe 102 2764 rundll32.exe 103 2764 rundll32.exe 104 2764 rundll32.exe 105 2764 rundll32.exe 106 2764 rundll32.exe 107 2764 rundll32.exe 108 2764 rundll32.exe 109 2764 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 2764 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3388 rundll32.exe 3388 rundll32.exe 3388 rundll32.exe 3388 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 3388 2352 cmd.exe 84 PID 2352 wrote to memory of 3388 2352 cmd.exe 84 PID 3388 wrote to memory of 2764 3388 rundll32.exe 90 PID 3388 wrote to memory of 2764 3388 rundll32.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\system32\rundll32.exerundll32.exe version1.dll, scab2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_a2518b77.dll", scab3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5f834dfc1861cd6361f34496c3bbafe66
SHA1a983e82d009901310c8a3255c4b4e3a02d556fa7
SHA256e99f3517a36a9f7a55335699cfb4d84d08b042d47146119156f7f3bab580b4d7
SHA512088a6170c948ddb2c2b0cf2431ae61688201ef5bc3f1af217a58bf18b26dd9e0ab7ee082f822e736d0467f62e33bf71b806127eb998bed8e739c1e441ac05e00
-
Filesize
1.4MB
MD5f834dfc1861cd6361f34496c3bbafe66
SHA1a983e82d009901310c8a3255c4b4e3a02d556fa7
SHA256e99f3517a36a9f7a55335699cfb4d84d08b042d47146119156f7f3bab580b4d7
SHA512088a6170c948ddb2c2b0cf2431ae61688201ef5bc3f1af217a58bf18b26dd9e0ab7ee082f822e736d0467f62e33bf71b806127eb998bed8e739c1e441ac05e00