79c5324a490a66906380ed976ca7bf4eb73f5d85fec3f2260a32937e391fd073

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a9ca1e90fd98d8339dd33c9b27d6d47.dll
Size

236KB
MD5

0a9ca1e90fd98d8339dd33c9b27d6d47
SHA1

6f22fa177f5fd7cad4d34fbc4ed8f7c8aeb8e452
SHA256

79c5324a490a66906380ed976ca7bf4eb73f5d85fec3f2260a32937e391fd073
SHA512

5d5d5e4d8bb4d0b006cdfc0ed09d40daf8e7d1d93f5653c22c85160da2c743cc682c4d27db833d62c9c33e501f8ae54b8ecd356e64000cf35fdd26250ca17da4
SSDEEP

1536:1dKaTHN2ymZ0ofa5uQm4V7HG8ldINh+RhFtFftCgpcGO5lPf/XG8GmGwktb3:1Y4tIQG8XAmbFfaGc1fawk13

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\sxxbehc = "{c7f9c30b-4f71-94c6-5082-4f714b83aa6b}"	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2288	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fkkorup.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\fkkorup.dll	rundll32.exe
File created	C:\Windows\SysWOW64\nsswzcx.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\nsswzcx.dll	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c7f9c30b-4f71-94c6-5082-4f714b83aa6b}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c7f9c30b-4f71-94c6-5082-4f714b83aa6b}\InprocServer32\ = "C:\\Windows\\SysWow64\\nsswzcx.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c7f9c30b-4f71-94c6-5082-4f714b83aa6b}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c7f9c30b-4f71-94c6-5082-4f714b83aa6b}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c7f9c30b-4f71-94c6-5082-4f714b83aa6b}\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2288	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2288	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2288	1052	rundll32.exe	16
PID 1052 wrote to memory of 2288	1052	rundll32.exe	16
PID 1052 wrote to memory of 2288	1052	rundll32.exe	16
PID 1052 wrote to memory of 2288	1052	rundll32.exe	16
PID 1052 wrote to memory of 2288	1052	rundll32.exe	16
PID 1052 wrote to memory of 2288	1052	rundll32.exe	16
PID 1052 wrote to memory of 2288	1052	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a9ca1e90fd98d8339dd33c9b27d6d47.dll,#1
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2288

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a9ca1e90fd98d8339dd33c9b27d6d47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\fkkorup.dll

Filesize
1KB

MD5
1d0cb179ddbf9541a743d36841e15712

SHA1
e21d72065d7a9ad6c17f28c865a9384a0635b649

SHA256
775fd0dad3ead0a33b0c736cf4488298019a6f506a4dc3c4ba85166054e02a8a

SHA512
f43ce0e41312e59ba7f44af1b9355fe40ea44bf07da7bcf07d6429e13cfc1696a0cdda4d82683eb874ca016cfdb0f07df576796a12c11bdc14c2e31649601a44

Download Submit
memory/2288-0-0x00000000001E0000-0x0000000000224000-memory.dmp

Filesize
272KB

Download
memory/2288-9-0x0000000075060000-0x0000000075100000-memory.dmp

Filesize
640KB

Download
memory/2288-8-0x00000000001E0000-0x0000000000224000-memory.dmp

Filesize
272KB

Download
memory/2288-11-0x0000000075060000-0x0000000075100000-memory.dmp

Filesize
640KB

Download
memory/2288-10-0x00000000001E0000-0x0000000000224000-memory.dmp

Filesize
272KB

Download