8f879d031041b092438350311423f478ea0f57a5225cd8686d6bb42722d6ddfc

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:40

Target

05e6f9c2c83bac8748277f1b1426eac3.dll
Size

60KB
MD5

05e6f9c2c83bac8748277f1b1426eac3
SHA1

1da78b870b200adc018dc3717eb08eb49e481942
SHA256

8f879d031041b092438350311423f478ea0f57a5225cd8686d6bb42722d6ddfc
SHA512

af676ecdbd64b319268f1b353d1d0f325f27e37813e5567ce33125ae48b421c7d051f8ef5d21fb434e23e5a35d166d7c9e89c6db59b14a4f24ff1b246f4c669c
SSDEEP

1536:9JiYU3BtpCdtWMrd4IJfzc5TOtnVxhxMU:9Jil3BHCdtWxSLMTOtVxgU

Score

8^/10

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	cmd.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4544-0-0x0000000010000000-0x000000001000F000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "regedit.exe /s \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings	cmd.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3168	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4544	4312	rundll32.exe	16
PID 4312 wrote to memory of 4544	4312	rundll32.exe	16
PID 4312 wrote to memory of 4544	4312	rundll32.exe	16
PID 4544 wrote to memory of 624	4544	rundll32.exe	22
PID 4544 wrote to memory of 624	4544	rundll32.exe	22
PID 4544 wrote to memory of 624	4544	rundll32.exe	22
PID 624 wrote to memory of 3168	624	cmd.exe	25
PID 624 wrote to memory of 3168	624	cmd.exe	25
PID 624 wrote to memory of 3168	624	cmd.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05e6f9c2c83bac8748277f1b1426eac3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312