Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 04:10
Static task
static1
Behavioral task
behavioral1
Sample
0490ca611a0e2b50bef8d8373327d790.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0490ca611a0e2b50bef8d8373327d790.dll
Resource
win10v2004-20231215-en
General
-
Target
0490ca611a0e2b50bef8d8373327d790.dll
-
Size
236KB
-
MD5
0490ca611a0e2b50bef8d8373327d790
-
SHA1
1d4769fcbac93ee61a6c03ef49e41721e936cc9b
-
SHA256
dc12f4b255c4811e149d407f2c7ca6d9fc44cfabe922ac1ca2aa1fc6d8ad6307
-
SHA512
55f2e272a4a2fd217ff1e52a6fe624fbba78f42fb913fe151523d59ed6197ea0f2ff6d4640db9d812a17794a70913cf5752bcc928693db08231bc88f52f1de1e
-
SSDEEP
1536:Iguo2K86vta10RJQYPIHL+D5IWhxRh/Ci4ucg3/+k5ltr+DRPG8Gz7wk+cQvMI:Go256vS0RJAL+lHPKi40+66iwkD0T
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vcp = "{f25a2d31-7ad2-cf27-8be3-7ad2a5b9c27e}" rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 2376 rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\qxk.dll rundll32.exe File created C:\Windows\SysWOW64\ipc.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\ipc.dll rundll32.exe File created C:\Windows\SysWOW64\qxk.dll rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f25a2d31-7ad2-cf27-8be3-7ad2a5b9c27e} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f25a2d31-7ad2-cf27-8be3-7ad2a5b9c27e}\ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f25a2d31-7ad2-cf27-8be3-7ad2a5b9c27e}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f25a2d31-7ad2-cf27-8be3-7ad2a5b9c27e}\InprocServer32\ = "C:\\Windows\\SysWow64\\qxk.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f25a2d31-7ad2-cf27-8be3-7ad2a5b9c27e}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2376 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2376 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2376 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2376 2372 rundll32.exe 16 PID 2372 wrote to memory of 2376 2372 rundll32.exe 16 PID 2372 wrote to memory of 2376 2372 rundll32.exe 16 PID 2372 wrote to memory of 2376 2372 rundll32.exe 16 PID 2372 wrote to memory of 2376 2372 rundll32.exe 16 PID 2372 wrote to memory of 2376 2372 rundll32.exe 16 PID 2372 wrote to memory of 2376 2372 rundll32.exe 16
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0490ca611a0e2b50bef8d8373327d790.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0490ca611a0e2b50bef8d8373327d790.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
604KB
MD5697b0b9257596771919fee389bb2e088
SHA132f52e3890ca41664d51d7654d85c0ac926f0f4f
SHA256ee12c048381cc56e0ccbef3d815f916b878ba8ac2d173f2dc9d7a9ed7fdb278b
SHA5125970390b9f63cfc618cf58da1e4170656349fca938de20f9f957d99cad31175dfe12381aa7c623aa833b97d9c8194a1e24b24e01dafd1f17d5d35c8d2edf8b57