bdf68e5e5c96f4ca8cac0354c4e79974a5afe47165058372f91b3c5660f0478f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LaunchManager_Dritek_7.0.4_W8x64/DelPrevV.dll
Size

199KB
MD5

5a9b1f3ccf5a5152c180a496fc80bec9
SHA1

86e45d2ef5f9a435acb4541419f9785eb6440fa6
SHA256

02f4024556b89156f39486439664ed86808de532303e7a37322ac919e26ccad0
SHA512

c19c8db249eab19f525913dbac735ce1622db46373e3fd7bac11e2e226ab015b62095c0ca7be673b7bc135913022bdbe86d0bfa41fd805dc713eef83b261b1ec
SSDEEP

3072:CsEvF3FLR3utqu3DTREKLOiQwLs3ue3B52AIj+eFtzMHrsSplvZNR6:CsEvFP3wrLJQwLstB53I6eFt/E6

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1640	sc.exe
2972	sc.exe
2728	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1760	2216	rundll32.exe	16
PID 2216 wrote to memory of 1760	2216	rundll32.exe	16
PID 2216 wrote to memory of 1760	2216	rundll32.exe	16
PID 2216 wrote to memory of 1760	2216	rundll32.exe	16
PID 2216 wrote to memory of 1760	2216	rundll32.exe	16
PID 2216 wrote to memory of 1760	2216	rundll32.exe	16
PID 2216 wrote to memory of 1760	2216	rundll32.exe	16
PID 1760 wrote to memory of 1668	1760	rundll32.exe	23
PID 1760 wrote to memory of 1668	1760	rundll32.exe	23
PID 1760 wrote to memory of 1668	1760	rundll32.exe	23
PID 1760 wrote to memory of 1668	1760	rundll32.exe	23
PID 1760 wrote to memory of 1668	1760	rundll32.exe	23
PID 1760 wrote to memory of 1668	1760	rundll32.exe	23
PID 1760 wrote to memory of 2972	1760	rundll32.exe	22
PID 1760 wrote to memory of 2972	1760	rundll32.exe	22
PID 1760 wrote to memory of 2972	1760	rundll32.exe	22
PID 1760 wrote to memory of 2972	1760	rundll32.exe	22
PID 1760 wrote to memory of 1640	1760	rundll32.exe	21
PID 1760 wrote to memory of 1640	1760	rundll32.exe	21
PID 1760 wrote to memory of 1640	1760	rundll32.exe	21
PID 1760 wrote to memory of 1640	1760	rundll32.exe	21
PID 1760 wrote to memory of 2728	1760	rundll32.exe	19
PID 1760 wrote to memory of 2728	1760	rundll32.exe	19
PID 1760 wrote to memory of 2728	1760	rundll32.exe	19
PID 1760 wrote to memory of 2728	1760	rundll32.exe	19

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LaunchManager_Dritek_7.0.4_W8x64\DelPrevV.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\sc.exe
  sc.exe delete DsiWMIService
  2⤵
  - Launches sc.exe
  PID:2728
- C:\Windows\SysWOW64\sc.exe
  sc.exe stop DsiWMIService
  2⤵
  - Launches sc.exe
  PID:1640
- C:\Windows\SysWOW64\sc.exe
  sc.exe control DsiWMIService 173
  2⤵
  - Launches sc.exe
  PID:2972
- C:\Users\Admin\AppData\Local\Temp\LaunchManager_Dritek_7.0.4_W8x64\LManager.exe
  LManager.exe Destroy
  2⤵
  PID:1668

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LaunchManager_Dritek_7.0.4_W8x64\DelPrevV.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-1-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/1668-5-0x0000000000350000-0x0000000000365000-memory.dmp

Filesize
84KB

Download
memory/1668-3-0x00000000001E0000-0x0000000000234000-memory.dmp

Filesize
336KB

Download
memory/1668-2-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/1668-0-0x0000000000020000-0x0000000000032000-memory.dmp

Filesize
72KB

Download