2b843fce686305b58cce27c914372ee7d6958d1773ce4a00771143b827f03ad1

Analysis

max time kernel
147s
max time network
173s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0861e49967eaeb9678a07b35eada3bd5.dll
Size

88KB
MD5

0861e49967eaeb9678a07b35eada3bd5
SHA1

fab6fbe04e1e85b6074b7c8c31b30913b53a56a9
SHA256

2b843fce686305b58cce27c914372ee7d6958d1773ce4a00771143b827f03ad1
SHA512

52fbcc6a8ff9ddbec02c6a08aa6bd4d63c63c80956559a170ffb31763198246d77c1b02df8c2031125900e9a4468a6057c00cf5c4ee1cd26fbaca412a9e6b587
SSDEEP

1536:e2tz1EZNj6sGUpNgMpNqJ1p8RJxKVHlEbnv8v7T6nMyQ4ySZap4HLG4GaJ3mBxxb:eIEZUsxGUNqJPKEHlmv8vangsgaJ3oS

Score

8^/10

evasion upx

Malware Config

Signatures

Blocklisted process makes network request 15 IoCs

flow	pid	Process
7	2532	rundll32.exe
8	2532	rundll32.exe
9	2532	rundll32.exe
10	2532	rundll32.exe
15	2532	rundll32.exe
17	2532	rundll32.exe
18	2532	rundll32.exe
19	2532	rundll32.exe
24	2532	rundll32.exe
29	2532	rundll32.exe
30	2532	rundll32.exe
33	2532	rundll32.exe
34	2532	rundll32.exe
36	2532	rundll32.exe
37	2532	rundll32.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2120	netsh.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2532-3-0x00000000000B0000-0x00000000000DD000-memory.dmp	upx
behavioral1/memory/2532-4-0x00000000000B0000-0x00000000000DD000-memory.dmp	upx
behavioral1/memory/2532-13-0x00000000000B0000-0x00000000000DD000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Security	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Security\installation_id = 3c91e654bc42504fa440472b4e601788	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2532	2072	rundll32.exe	28
PID 2072 wrote to memory of 2532	2072	rundll32.exe	28
PID 2072 wrote to memory of 2532	2072	rundll32.exe	28
PID 2072 wrote to memory of 2532	2072	rundll32.exe	28
PID 2072 wrote to memory of 2532	2072	rundll32.exe	28
PID 2072 wrote to memory of 2532	2072	rundll32.exe	28
PID 2072 wrote to memory of 2532	2072	rundll32.exe	28
PID 2532 wrote to memory of 2120	2532	rundll32.exe	29
PID 2532 wrote to memory of 2120	2532	rundll32.exe	29
PID 2532 wrote to memory of 2120	2532	rundll32.exe	29
PID 2532 wrote to memory of 2120	2532	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0861e49967eaeb9678a07b35eada3bd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0861e49967eaeb9678a07b35eada3bd5.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\SysWOW64\rundll32.exe" "Explorer" enable
    3⤵
    - Modifies Windows Firewall
    PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-0-0x00000000000A0000-0x00000000000CD000-memory.dmp

Filesize
180KB

Download
memory/2532-1-0x00000000000A0000-0x00000000000CD000-memory.dmp

Filesize
180KB

Download
memory/2532-2-0x00000000000A0000-0x00000000000CD000-memory.dmp

Filesize
180KB

Download
memory/2532-3-0x00000000000B0000-0x00000000000DD000-memory.dmp

Filesize
180KB

Download
memory/2532-4-0x00000000000B0000-0x00000000000DD000-memory.dmp

Filesize
180KB

Download
memory/2532-6-0x00000000000A0000-0x00000000000CD000-memory.dmp

Filesize
180KB

Download
memory/2532-7-0x00000000000A0000-0x00000000000CD000-memory.dmp

Filesize
180KB

Download
memory/2532-8-0x00000000000A0000-0x00000000000CD000-memory.dmp

Filesize
180KB

Download
memory/2532-13-0x00000000000B0000-0x00000000000DD000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads