c2e8f3bfca9279d3858c47565c44f037703f4dd8276d849446d0c9f8a143198f

Analysis

max time kernel
162s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

175faea9618f9cf9817326899abeb845.dll
Size

7KB
MD5

175faea9618f9cf9817326899abeb845
SHA1

e8305bec1f0a55ea4e2d00f9dc5fa24eb88e6a9b
SHA256

c2e8f3bfca9279d3858c47565c44f037703f4dd8276d849446d0c9f8a143198f
SHA512

8e6d49ecae49a68864897142081b6a03dff85fb758ea934659783f49f48ee0c4ae2ddc1de1aab573bc0cd12ef12acb4954be3e4ef284678f5efb30edb4213213
SSDEEP

192:+F7LhJxrnFSD8x9Hkab2Q+hpoDYQESoDnQ9+XRDJ66kgUwuj:+F/RFIM9HkOb8nSmQ9+hd61d

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 4316	1368	rundll32.exe	90
PID 1368 wrote to memory of 4316	1368	rundll32.exe	90
PID 1368 wrote to memory of 4316	1368	rundll32.exe	90
PID 4316 wrote to memory of 3520	4316	rundll32.exe	56

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\175faea9618f9cf9817326899abeb845.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\175faea9618f9cf9817326899abeb845.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4316

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4316-0-0x0000000025000000-0x0000000025014000-memory.dmp

Filesize
80KB

Download