a46b7cd58efb64bc095bdace2e1b90d6bf31922006426c1f89166e46e09e2500

General

Target

4b596827775c0c50eda4286b70630737.exe
Size

132KB
MD5

4b596827775c0c50eda4286b70630737
SHA1

1f2148c769e49b3ec2ffbc1e8018b29739df4853
SHA256

a46b7cd58efb64bc095bdace2e1b90d6bf31922006426c1f89166e46e09e2500
SHA512

ac207c415049a19dea9e42166c99e8dfbf74a8930690436fd730ca0f2f40a319be200eebc98eb6f30795d0e911175ea1c80f64c3820b8efb30affd4667e07402
SSDEEP

3072:FLQdOPskC6N13sbivD/tN8bIOslG73fuOgKOlRUJgBSI6:dFCSds+vDlNyIOslwfuOgtS

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2628	rundll32.exe
2628	rundll32.exe
2628	rundll32.exe
2628	rundll32.exe
2752	rundll32.exe
2752	rundll32.exe
2752	rundll32.exe
2752	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uparoqenezu = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\dhetuls.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2628	rundll32.exe
2628	rundll32.exe
2628	rundll32.exe
2628	rundll32.exe
2628	rundll32.exe
2628	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2312	4b596827775c0c50eda4286b70630737.exe
2628	rundll32.exe
2752	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2628	2312	4b596827775c0c50eda4286b70630737.exe	28
PID 2312 wrote to memory of 2628	2312	4b596827775c0c50eda4286b70630737.exe	28
PID 2312 wrote to memory of 2628	2312	4b596827775c0c50eda4286b70630737.exe	28
PID 2312 wrote to memory of 2628	2312	4b596827775c0c50eda4286b70630737.exe	28
PID 2312 wrote to memory of 2628	2312	4b596827775c0c50eda4286b70630737.exe	28
PID 2312 wrote to memory of 2628	2312	4b596827775c0c50eda4286b70630737.exe	28
PID 2312 wrote to memory of 2628	2312	4b596827775c0c50eda4286b70630737.exe	28
PID 2628 wrote to memory of 2752	2628	rundll32.exe	29
PID 2628 wrote to memory of 2752	2628	rundll32.exe	29
PID 2628 wrote to memory of 2752	2628	rundll32.exe	29
PID 2628 wrote to memory of 2752	2628	rundll32.exe	29
PID 2628 wrote to memory of 2752	2628	rundll32.exe	29
PID 2628 wrote to memory of 2752	2628	rundll32.exe	29
PID 2628 wrote to memory of 2752	2628	rundll32.exe	29

C:\Users\Admin\AppData\Local\Temp\4b596827775c0c50eda4286b70630737.exe
"C:\Users\Admin\AppData\Local\Temp\4b596827775c0c50eda4286b70630737.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\dhetuls.dll",Startup
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\dhetuls.dll",iep
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\dhetuls.dll

Filesize
132KB

MD5
61e4eee668cc2526b29d8911e68186a6

SHA1
378d9db1de5691867da0fbd855bc2748b9220445

SHA256
7f5f0b61e6221504f5c20c8619648fbad15507d6eb33cd21f9b0ea8d239c4dd2

SHA512
4b31bd01782e1fcd2fa92578e9b02165185e8083dc8b59cffba2625701dac6d437d1ad2cebe872cfd8bae6fe0c7b0d24c0c17adbb91403763e8609b2a5b0b095

Download Submit
\Users\Admin\AppData\Local\dhetuls.dll

Filesize
39KB

MD5
f3ffe9424f6b02e81e8c03ce339c1ab3

SHA1
59f778bc42c0061fd8368589ac5c396e3d976faa

SHA256
c8581fc59233aca51bf6fa014fc6968441ca4d87d05c0b7259c65898299c7194

SHA512
8f9cbc8200f4296ad6b3af35da9c359b1f40431a261e9c4e10f1a202874ff8113b8fa5de06cdba5e289529750df4df07268aaa08b418864865fc7e1e85a9aec8

Download Submit
memory/2312-12-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2312-1-0x0000000001DD0000-0x0000000001E10000-memory.dmp

Filesize
256KB

Download
memory/2312-2-0x0000000001DD0000-0x0000000001E10000-memory.dmp

Filesize
256KB

Download
memory/2312-16-0x0000000001DD0000-0x0000000001E10000-memory.dmp

Filesize
256KB

Download
memory/2312-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2628-13-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2628-11-0x00000000001F0000-0x0000000000230000-memory.dmp

Filesize
256KB

Download
memory/2628-10-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2628-23-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2628-26-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2752-25-0x0000000002270000-0x00000000022B0000-memory.dmp

Filesize
256KB

Download
memory/2752-24-0x0000000002270000-0x00000000022B0000-memory.dmp

Filesize
256KB

Download
memory/2752-27-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2752-30-0x0000000002270000-0x00000000022B0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads