Analysis
-
max time kernel
134s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
03-12-2023 16:26
Static task
static1
Behavioral task
behavioral1
Sample
9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll
Resource
win10v2004-20231130-en
General
-
Target
9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll
-
Size
6.4MB
-
MD5
8adb83307ae6216a76e6287e0fc3ce41
-
SHA1
f0f8340c3ad4a8d2b5c1b9ac18cdee135f96402f
-
SHA256
9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c
-
SHA512
85f5e4e3c3b092fba0e395303ffe2d9b55544e2e817f681b0024dac2fbae71f788f68714d78fab29ca83d0c617fd17b3eec5ebcd74fe7576f35e668e2fde1278
-
SSDEEP
98304:l0bENqXyMP0OSU/DktQJ54niDXQNUw40DlSDB7lZz3mZg+9d7Kvos2UvMcXyI:l04DIrRFbQmD0DlSdlZ3mZgyxxsQ0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 2148 rundll32mgr.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 2208 rundll32.exe 2208 rundll32.exe -
Processes:
resource yara_rule \Windows\SysWOW64\rundll32mgr.exe upx C:\Windows\SysWOW64\rundll32mgr.exe upx C:\Windows\SysWOW64\rundll32mgr.exe upx \Windows\SysWOW64\rundll32mgr.exe upx behavioral1/memory/2148-18-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral1/memory/2148-27-0x0000000000400000-0x0000000000454000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 2208 rundll32.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407782708" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7330A81-91F8-11EE-BDDB-62E05E806CC4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C73A2EA1-91F8-11EE-BDDB-62E05E806CC4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
rundll32.exerundll32mgr.exepid process 2208 rundll32.exe 2148 rundll32mgr.exe 2148 rundll32mgr.exe 2148 rundll32mgr.exe 2148 rundll32mgr.exe 2148 rundll32mgr.exe 2148 rundll32mgr.exe 2148 rundll32mgr.exe 2148 rundll32mgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3024 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32mgr.exedescription pid process Token: SeDebugPrivilege 2148 rundll32mgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 2644 iexplore.exe 3024 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 2644 iexplore.exe 2644 iexplore.exe 3024 iexplore.exe 3024 iexplore.exe 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exeiexplore.exeiexplore.exedescription pid process target process PID 320 wrote to memory of 2208 320 rundll32.exe rundll32.exe PID 320 wrote to memory of 2208 320 rundll32.exe rundll32.exe PID 320 wrote to memory of 2208 320 rundll32.exe rundll32.exe PID 320 wrote to memory of 2208 320 rundll32.exe rundll32.exe PID 320 wrote to memory of 2208 320 rundll32.exe rundll32.exe PID 320 wrote to memory of 2208 320 rundll32.exe rundll32.exe PID 320 wrote to memory of 2208 320 rundll32.exe rundll32.exe PID 2208 wrote to memory of 2148 2208 rundll32.exe rundll32mgr.exe PID 2208 wrote to memory of 2148 2208 rundll32.exe rundll32mgr.exe PID 2208 wrote to memory of 2148 2208 rundll32.exe rundll32mgr.exe PID 2208 wrote to memory of 2148 2208 rundll32.exe rundll32mgr.exe PID 2148 wrote to memory of 3024 2148 rundll32mgr.exe iexplore.exe PID 2148 wrote to memory of 3024 2148 rundll32mgr.exe iexplore.exe PID 2148 wrote to memory of 3024 2148 rundll32mgr.exe iexplore.exe PID 2148 wrote to memory of 3024 2148 rundll32mgr.exe iexplore.exe PID 2148 wrote to memory of 2644 2148 rundll32mgr.exe iexplore.exe PID 2148 wrote to memory of 2644 2148 rundll32mgr.exe iexplore.exe PID 2148 wrote to memory of 2644 2148 rundll32mgr.exe iexplore.exe PID 2148 wrote to memory of 2644 2148 rundll32mgr.exe iexplore.exe PID 2644 wrote to memory of 2356 2644 iexplore.exe IEXPLORE.EXE PID 2644 wrote to memory of 2356 2644 iexplore.exe IEXPLORE.EXE PID 2644 wrote to memory of 2356 2644 iexplore.exe IEXPLORE.EXE PID 2644 wrote to memory of 2356 2644 iexplore.exe IEXPLORE.EXE PID 3024 wrote to memory of 2544 3024 iexplore.exe IEXPLORE.EXE PID 3024 wrote to memory of 2544 3024 iexplore.exe IEXPLORE.EXE PID 3024 wrote to memory of 2544 3024 iexplore.exe IEXPLORE.EXE PID 3024 wrote to memory of 2544 3024 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C73A2EA1-91F8-11EE-BDDB-62E05E806CC4}.datFilesize
5KB
MD5e8dbdabd156744e71211c288ffac9120
SHA10ca63d3fc31d4c236bb2f4b86d1fd829d2b0f3e6
SHA25630da83db85e30c1734833a39c3d031094dbe1577f733f3256ed6352d0e67ff89
SHA5124eb01e0597b6fd7429f957ca708109f3d30d56e466346e4ba9c1afacc8b825a75a154901107adc47869aaea21253a77cb9260f2a542d71550c125c63f1e5ad92
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
99KB
MD5f3873258a4258a6761dc54d47463182f
SHA1fbbf8bca739ca4e9745e5224662b33b437a52461
SHA25663b02a3e8e7e049d1f29cd4cd79fe5c8905754da6c023df72aa5cca351d0d5c5
SHA512eec16bb41fd05d9acd5d2b17eb5218057c3cd97cd706e0782a64eb2c32f8a57f1206fe0268be7f37a9f1c3f7b8eb09767cf2724951eaee4be03c4d509d4b3dd4
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
99KB
MD5f3873258a4258a6761dc54d47463182f
SHA1fbbf8bca739ca4e9745e5224662b33b437a52461
SHA25663b02a3e8e7e049d1f29cd4cd79fe5c8905754da6c023df72aa5cca351d0d5c5
SHA512eec16bb41fd05d9acd5d2b17eb5218057c3cd97cd706e0782a64eb2c32f8a57f1206fe0268be7f37a9f1c3f7b8eb09767cf2724951eaee4be03c4d509d4b3dd4
-
\Windows\SysWOW64\rundll32mgr.exeFilesize
99KB
MD5f3873258a4258a6761dc54d47463182f
SHA1fbbf8bca739ca4e9745e5224662b33b437a52461
SHA25663b02a3e8e7e049d1f29cd4cd79fe5c8905754da6c023df72aa5cca351d0d5c5
SHA512eec16bb41fd05d9acd5d2b17eb5218057c3cd97cd706e0782a64eb2c32f8a57f1206fe0268be7f37a9f1c3f7b8eb09767cf2724951eaee4be03c4d509d4b3dd4
-
\Windows\SysWOW64\rundll32mgr.exeFilesize
99KB
MD5f3873258a4258a6761dc54d47463182f
SHA1fbbf8bca739ca4e9745e5224662b33b437a52461
SHA25663b02a3e8e7e049d1f29cd4cd79fe5c8905754da6c023df72aa5cca351d0d5c5
SHA512eec16bb41fd05d9acd5d2b17eb5218057c3cd97cd706e0782a64eb2c32f8a57f1206fe0268be7f37a9f1c3f7b8eb09767cf2724951eaee4be03c4d509d4b3dd4
-
memory/2148-18-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/2148-27-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/2148-11-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/2148-21-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2148-23-0x000000007753F000-0x0000000077540000-memory.dmpFilesize
4KB
-
memory/2148-12-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2208-15-0x0000000074520000-0x0000000074B93000-memory.dmpFilesize
6.4MB
-
memory/2208-20-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2208-24-0x0000000000930000-0x0000000000984000-memory.dmpFilesize
336KB
-
memory/2208-14-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2208-25-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2208-19-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2208-9-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2208-8-0x0000000074520000-0x0000000074B93000-memory.dmpFilesize
6.4MB
-
memory/2208-17-0x0000000000930000-0x0000000000984000-memory.dmpFilesize
336KB
-
memory/2208-13-0x0000000073EA0000-0x0000000074513000-memory.dmpFilesize
6.4MB
-
memory/2208-28-0x0000000000930000-0x0000000000984000-memory.dmpFilesize
336KB
-
memory/2208-29-0x0000000000930000-0x0000000000984000-memory.dmpFilesize
336KB