Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 13:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3751c1c1ddcd84451a3ced3fc9a2863d.dll
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
3751c1c1ddcd84451a3ced3fc9a2863d.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
3751c1c1ddcd84451a3ced3fc9a2863d.dll
-
Size
24KB
-
MD5
3751c1c1ddcd84451a3ced3fc9a2863d
-
SHA1
d58a9437545bce947a5d851cef2e5f2971106536
-
SHA256
8f988aeb16b184e584ec993fd1d8a7d9cb20c773ebb1d9159775ee8d60668de6
-
SHA512
623b53eff7203a8e1bee5b778968394a33d5d4a3aa73583dc91782b622a3c19fc1d5d8197b5384ed17d9555a421da3ad1295e01674ada51aa27a28d97ce7e4f4
-
SSDEEP
384:oYeMjyec2GdaoaAWVY7pvBvBvuUEe8T9PgoRsCVVSJ/inoocj0zwstn6:MMhc2yaoLavdeEPgoRpjhnUW0
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 2108 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\cbXPfCtr.dll,#1" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cbXPfCtr.dll rundll32.exe File created C:\Windows\SysWOW64\cbXPfCtr.dll rundll32.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A39F3CC6-5D6E-4A86-9295-6BD60D5C3471} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A39F3CC6-5D6E-4A86-9295-6BD60D5C3471}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A39F3CC6-5D6E-4A86-9295-6BD60D5C3471}\InprocServer32\ = "C:\\Windows\\SysWow64\\cbXPfCtr.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A39F3CC6-5D6E-4A86-9295-6BD60D5C3471}\InprocServer32\ThreadingModel = "Both" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2108 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2108 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2108 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2108 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 292 wrote to memory of 2108 292 rundll32.exe 28 PID 292 wrote to memory of 2108 292 rundll32.exe 28 PID 292 wrote to memory of 2108 292 rundll32.exe 28 PID 292 wrote to memory of 2108 292 rundll32.exe 28 PID 292 wrote to memory of 2108 292 rundll32.exe 28 PID 292 wrote to memory of 2108 292 rundll32.exe 28 PID 292 wrote to memory of 2108 292 rundll32.exe 28 PID 2108 wrote to memory of 436 2108 rundll32.exe 3 PID 2108 wrote to memory of 2604 2108 rundll32.exe 29 PID 2108 wrote to memory of 2604 2108 rundll32.exe 29 PID 2108 wrote to memory of 2604 2108 rundll32.exe 29 PID 2108 wrote to memory of 2604 2108 rundll32.exe 29 PID 2108 wrote to memory of 2604 2108 rundll32.exe 29 PID 2108 wrote to memory of 2604 2108 rundll32.exe 29 PID 2108 wrote to memory of 2604 2108 rundll32.exe 29
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3751c1c1ddcd84451a3ced3fc9a2863d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3751c1c1ddcd84451a3ced3fc9a2863d.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\cbXPfCtr.dll,a3⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2604
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD53751c1c1ddcd84451a3ced3fc9a2863d
SHA1d58a9437545bce947a5d851cef2e5f2971106536
SHA2568f988aeb16b184e584ec993fd1d8a7d9cb20c773ebb1d9159775ee8d60668de6
SHA512623b53eff7203a8e1bee5b778968394a33d5d4a3aa73583dc91782b622a3c19fc1d5d8197b5384ed17d9555a421da3ad1295e01674ada51aa27a28d97ce7e4f4