43cc037d555a05e492937162bb9a2e51297217c06c0de9eb0c5295293efe1ac8

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

25f5f26f6470a9c9a4c2a74fe9838bb1.dll
Size

9KB
MD5

25f5f26f6470a9c9a4c2a74fe9838bb1
SHA1

3987de76735d399a883ca174ff3073ae7dea9cf5
SHA256

43cc037d555a05e492937162bb9a2e51297217c06c0de9eb0c5295293efe1ac8
SHA512

abadfba6489d2bebfa75605a804ce1faa21d08b21e07912294e593b7e20e99f237243902b68e47c17125389b90d6c180731afde8b61fda570c7aad2f66fd8c5b
SSDEEP

192:clXE//Y23cyksAkiXDxDguTVtaUrw81Der8:clXC/0yJYxlTHa2De

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = ",C:\\Windows\\system32\\ntvdm32.exe"	rundll32.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	1960	rundll32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1960-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1960	4472	rundll32.exe	14
PID 4472 wrote to memory of 1960	4472	rundll32.exe	14
PID 4472 wrote to memory of 1960	4472	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f5f26f6470a9c9a4c2a74fe9838bb1.dll,#1
1⤵
- Modifies WinLogon for persistence
- Blocklisted process makes network request
PID:1960

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f5f26f6470a9c9a4c2a74fe9838bb1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads