Analysis
-
max time kernel
140s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06d82b88bedd63f924385ee0911813a6.dll
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
06d82b88bedd63f924385ee0911813a6.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
06d82b88bedd63f924385ee0911813a6.dll
-
Size
236KB
-
MD5
06d82b88bedd63f924385ee0911813a6
-
SHA1
a8249b1f20805ddb18a572315c5b115ead95239a
-
SHA256
e40d10e6c204cdf5bbd9e234abb32ec33803420f558ab755a582f4ef2a2c9533
-
SHA512
8e518743897a4f9088cc1b411ec2ea655f758f12c8ef20933c39b3761d79b93080b1f997358c19ef1173239a1bf6d3e46519f25b511967fd4415dca227a62018
-
SSDEEP
3072:3F24fliN+7XlmZKxbLYH1rhAwHL5K2W5QVgxwkFZ:3F24flic7X8ZibLYHFhAkKZYgnZ
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\aciqhos = "{a6eadc0c-2e62-73b7-3f73-2e6254845779}" rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 4412 rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\npvdubf.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\npvdubf.dll rundll32.exe File created C:\Windows\SysWOW64\vxdlcjn.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\vxdlcjn.dll rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a6eadc0c-2e62-73b7-3f73-2e6254845779}\ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a6eadc0c-2e62-73b7-3f73-2e6254845779}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a6eadc0c-2e62-73b7-3f73-2e6254845779}\InprocServer32\ = "C:\\Windows\\SysWow64\\vxdlcjn.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a6eadc0c-2e62-73b7-3f73-2e6254845779}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a6eadc0c-2e62-73b7-3f73-2e6254845779} rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4412 rundll32.exe 4412 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4412 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4412 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2544 wrote to memory of 4412 2544 rundll32.exe 14 PID 2544 wrote to memory of 4412 2544 rundll32.exe 14 PID 2544 wrote to memory of 4412 2544 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06d82b88bedd63f924385ee0911813a6.dll,#11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4412
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06d82b88bedd63f924385ee0911813a6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2544