e9b4b76ab1b1300eef11fc56a63a18391b87d0c9eac32b75540129d69f8a223f

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d92603aabb46e9560e179c555864559.dll
Size

15KB
MD5

0d92603aabb46e9560e179c555864559
SHA1

3c885cc69d21afda4a48160444928f217fa86ae0
SHA256

e9b4b76ab1b1300eef11fc56a63a18391b87d0c9eac32b75540129d69f8a223f
SHA512

df71e830ab296217cf2700d4975213a7194d056b3c38a7a30e7c001e09f387483ae21251419f9857ed35dca058dab0fc93bbffc6a8800e7974ca4ab6da48d28b
SSDEEP

384:r+QlxkZ0+7iFlu+cvEMUi/CisvxpCxKH1G:r+6kZ3ivi/zs5pQoU

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mseion.sys	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1636	rundll32.exe
1636	rundll32.exe
1636	rundll32.exe
1636	rundll32.exe
1636	rundll32.exe
1636	rundll32.exe
1636	rundll32.exe
1636	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1636	2256	rundll32.exe	28
PID 2256 wrote to memory of 1636	2256	rundll32.exe	28
PID 2256 wrote to memory of 1636	2256	rundll32.exe	28
PID 2256 wrote to memory of 1636	2256	rundll32.exe	28
PID 2256 wrote to memory of 1636	2256	rundll32.exe	28
PID 2256 wrote to memory of 1636	2256	rundll32.exe	28
PID 2256 wrote to memory of 1636	2256	rundll32.exe	28
PID 1636 wrote to memory of 1360	1636	rundll32.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1360
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d92603aabb46e9560e179c555864559.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d92603aabb46e9560e179c555864559.dll,#1
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-4-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/1636-0-0x0000000025000000-0x000000002501B000-memory.dmp

Filesize
108KB

Download
memory/1636-1-0x0000000025000000-0x000000002501B000-memory.dmp

Filesize
108KB

Download
memory/1636-2-0x0000000025000000-0x000000002501B000-memory.dmp

Filesize
108KB

Download