Analysis
-
max time kernel
124s -
max time network
129s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
07-12-2023 23:25
Static task
static1
Behavioral task
behavioral1
Sample
9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe
Resource
win10-20231023-en
General
-
Target
9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe
-
Size
3.1MB
-
MD5
1315c171c471295c843ab9313658b8a6
-
SHA1
85ff530634c4ef848d9096dff77390e47960943b
-
SHA256
9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970
-
SHA512
7b60ff58a60425b1313cd47f13cebcd60ccb710aba2ca78f2fe3518a4f2493735a442283945f8efbc357c08f62b6617246ef765cf97a0abe3a36089977d93aa6
-
SSDEEP
49152:yelloiE9H8Djckmbe7B/eklth60pN023qtIlHr0kogPLtFgE31IF1K3J8:yeljcRbexemhPN0qqIo6LtFgC1If+J8
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4536 rundll32.exe 3428 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings cmd.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.execmd.execontrol.exerundll32.exeRunDll32.exedescription pid process target process PID 2168 wrote to memory of 5064 2168 9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe cmd.exe PID 2168 wrote to memory of 5064 2168 9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe cmd.exe PID 2168 wrote to memory of 5064 2168 9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe cmd.exe PID 5064 wrote to memory of 4424 5064 cmd.exe control.exe PID 5064 wrote to memory of 4424 5064 cmd.exe control.exe PID 5064 wrote to memory of 4424 5064 cmd.exe control.exe PID 4424 wrote to memory of 4536 4424 control.exe rundll32.exe PID 4424 wrote to memory of 4536 4424 control.exe rundll32.exe PID 4424 wrote to memory of 4536 4424 control.exe rundll32.exe PID 4536 wrote to memory of 200 4536 rundll32.exe RunDll32.exe PID 4536 wrote to memory of 200 4536 rundll32.exe RunDll32.exe PID 200 wrote to memory of 3428 200 RunDll32.exe rundll32.exe PID 200 wrote to memory of 3428 200 RunDll32.exe rundll32.exe PID 200 wrote to memory of 3428 200 RunDll32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe"C:\Users\Admin\AppData\Local\Temp\9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z7A793878\jH4FZWk.bAt" "2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL",3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL",4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL",5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL",6⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPLFilesize
4.1MB
MD5d5e18b5f783d8142d3b3409656b24cb3
SHA1d7e44f49cc2f4e0dceb8b9a59ea2ca28472fca74
SHA25644893fa8ae248b7b73d2c85196105fc70ea03e6ee05bdd76da99fcda448fe262
SHA512f4a515fae914efae746d95266ae9f5778164928a8d4b517700d054094aa9a3ac5b3ce493246f5fe987858430d287498f7e5ddeeeef9cad8de7461b230a2cebe0
-
C:\Users\Admin\AppData\Local\Temp\7z7A793878\jH4FZWk.bAtFilesize
92B
MD52f18b38283c4436e789351ac86931cfc
SHA119c87c1316d8c48b2ac0cefe800c68f6f83505db
SHA2566fcf4241edf0418e37c21dece6c63ebbc2e738d67ec8a5981e0efa83f6a0b09f
SHA512b8e117158f63773e2b09eba2c7a8f5163e07b4e649ea0a1f96e19f5073646eea42d5c264eae756ceba4fce58094e6ddcaa5200eba73aa88ee5228401c8b899fe
-
\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPLFilesize
4.1MB
MD5d5e18b5f783d8142d3b3409656b24cb3
SHA1d7e44f49cc2f4e0dceb8b9a59ea2ca28472fca74
SHA25644893fa8ae248b7b73d2c85196105fc70ea03e6ee05bdd76da99fcda448fe262
SHA512f4a515fae914efae746d95266ae9f5778164928a8d4b517700d054094aa9a3ac5b3ce493246f5fe987858430d287498f7e5ddeeeef9cad8de7461b230a2cebe0
-
\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPLFilesize
4.1MB
MD5d5e18b5f783d8142d3b3409656b24cb3
SHA1d7e44f49cc2f4e0dceb8b9a59ea2ca28472fca74
SHA25644893fa8ae248b7b73d2c85196105fc70ea03e6ee05bdd76da99fcda448fe262
SHA512f4a515fae914efae746d95266ae9f5778164928a8d4b517700d054094aa9a3ac5b3ce493246f5fe987858430d287498f7e5ddeeeef9cad8de7461b230a2cebe0
-
memory/3428-27-0x0000000004E70000-0x0000000004F87000-memory.dmpFilesize
1.1MB
-
memory/3428-26-0x0000000004E70000-0x0000000004F87000-memory.dmpFilesize
1.1MB
-
memory/3428-23-0x0000000004E70000-0x0000000004F87000-memory.dmpFilesize
1.1MB
-
memory/3428-22-0x0000000005740000-0x0000000005873000-memory.dmpFilesize
1.2MB
-
memory/3428-19-0x0000000003590000-0x0000000003596000-memory.dmpFilesize
24KB
-
memory/4536-9-0x0000000000BB0000-0x0000000000BB6000-memory.dmpFilesize
24KB
-
memory/4536-17-0x0000000004F20000-0x0000000005037000-memory.dmpFilesize
1.1MB
-
memory/4536-16-0x0000000004F20000-0x0000000005037000-memory.dmpFilesize
1.1MB
-
memory/4536-13-0x0000000004F20000-0x0000000005037000-memory.dmpFilesize
1.1MB
-
memory/4536-12-0x0000000004DE0000-0x0000000004F13000-memory.dmpFilesize
1.2MB
-
memory/4536-10-0x0000000010000000-0x0000000010418000-memory.dmpFilesize
4.1MB