e4bb2247f4336a3f35df56cd564c7c66cef79414e3b82c3f6688431fb224099a

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0207350b914401ce4d3f28b11014a761.dll
Size

240KB
MD5

0207350b914401ce4d3f28b11014a761
SHA1

08240b0585f3307b1d6775187abac8165a5e62ca
SHA256

e4bb2247f4336a3f35df56cd564c7c66cef79414e3b82c3f6688431fb224099a
SHA512

44543a448723e1d8ad8ebe114963d89a33074de08c134b73b04b0fb6a8ed2b324c31d13b6df1750db8c61de77334d0582022f292c1bb28f8f34eca719651db6a
SSDEEP

3072:YQ9aMPTcXSi3SUzKT7H9b3K/aEd2c2s7rtke:dcdpeT7BK/Lcc9p

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\xeqnw = "{f40f6906-7c87-c1dc-8d98-7c87e18e9ab5}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
2352	rundll32.exe
2352	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\krdaj.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\krdaj.dll	rundll32.exe
File created	C:\Windows\SysWOW64\wdpmv.dll	rundll32.exe
File created	C:\Windows\SysWOW64\szlir.dll	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f40f6906-7c87-c1dc-8d98-7c87e18e9ab5}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f40f6906-7c87-c1dc-8d98-7c87e18e9ab5}\InprocServer32\ = "C:\\Windows\\SysWow64\\szlir.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f40f6906-7c87-c1dc-8d98-7c87e18e9ab5}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f40f6906-7c87-c1dc-8d98-7c87e18e9ab5}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f40f6906-7c87-c1dc-8d98-7c87e18e9ab5}\	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2352	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2352	1412	rundll32.exe	14
PID 1412 wrote to memory of 2352	1412	rundll32.exe	14
PID 1412 wrote to memory of 2352	1412	rundll32.exe	14
PID 1412 wrote to memory of 2352	1412	rundll32.exe	14
PID 1412 wrote to memory of 2352	1412	rundll32.exe	14
PID 1412 wrote to memory of 2352	1412	rundll32.exe	14
PID 1412 wrote to memory of 2352	1412	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0207350b914401ce4d3f28b11014a761.dll,#1
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2352

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0207350b914401ce4d3f28b11014a761.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\krdaj.dll

Filesize
67KB

MD5
6a9f751e8d62903e135cc4afc1baea2e

SHA1
261fb60f6bdc4eb266b292c1c36c63ed3ce4d394

SHA256
c6aad82dee9c0ee201c43201ad1cb5dbf80781f2c492eb368c37b570a486a2a8

SHA512
8d1ec6249e8b1a463a525949384ed84f75a85f1fc30744702b16c24edcdfbd77668300506c273645797b7cf8fbe545c80404baef70300ff70b106c580ec91df3

Download Submit
\Windows\SysWOW64\wdpmv.dll

Filesize
166KB

MD5
e4d1623a19e5688d272ebac82713b299

SHA1
8eccf878f757d09ff805aab1074704c614b7e20a

SHA256
41828d134a35aeeea73c548ada8b903a2ef4b750617520407d425a8de05b0f2d

SHA512
d9a5c6a08672438c118b93289a093f7ab37fcf4412744d19782157b11358196255ac870655fac8e9d132e28b59c6979379280cdf41772f25b573ec6539c8f6ad

Download Submit
memory/2352-12-0x00000000771F0000-0x0000000077300000-memory.dmp

Filesize
1.1MB

Download
memory/2352-15-0x00000000771F0000-0x0000000077300000-memory.dmp

Filesize
1.1MB

Download
memory/2352-14-0x00000000771F0000-0x0000000077300000-memory.dmp

Filesize
1.1MB

Download
memory/2352-13-0x0000000075BF0000-0x0000000075C90000-memory.dmp

Filesize
640KB

Download
memory/2352-11-0x0000000000230000-0x0000000000274000-memory.dmp

Filesize
272KB

Download
memory/2352-0-0x0000000000230000-0x0000000000274000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads