96b09dbac459eaedab6b4648068d1f9c73bb769678ac3981a8544f8d5d014b0f

Analysis

max time kernel
40s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

520d4f89e4d8d362e8ea066f54b242e7.dll
Size

24KB
MD5

520d4f89e4d8d362e8ea066f54b242e7
SHA1

c738ec2dfc13192bb185eb8afe6719c11c8f4a95
SHA256

96b09dbac459eaedab6b4648068d1f9c73bb769678ac3981a8544f8d5d014b0f
SHA512

973006c65ee9ad77dac0d93245705be714b683b3b552fe5fdb5c66a3b7dc7a0af579fab947344724cb4d442d418d81acedae1188dfeb9d0043f796e8b7dd9f9d
SSDEEP

384:mInxmfxQ9cb+RTM3/8pUBkj/gaIkBGYMqt3epyh0C/jnJPX6wWkfrkxIQ:VxmfxQOOMP82c1IkBGYT0yhJjJP6jkfM

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1888	rundll32.exe
1888	rundll32.exe
2904	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\hgGyxXrQ.dll,#1"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hgGyxXrQ.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\hgGyxXrQ.dll	rundll32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F30B1B0B-C305-414E-A4FF-AC93A08DE0AC}\InprocServer32\ThreadingModel = "Both"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F30B1B0B-C305-414E-A4FF-AC93A08DE0AC}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F30B1B0B-C305-414E-A4FF-AC93A08DE0AC}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F30B1B0B-C305-414E-A4FF-AC93A08DE0AC}\InprocServer32\ = "C:\\Windows\\SysWow64\\hgGyxXrQ.dll"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1888	rundll32.exe
1888	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1888	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1888	3004	rundll32.exe	14
PID 3004 wrote to memory of 1888	3004	rundll32.exe	14
PID 3004 wrote to memory of 1888	3004	rundll32.exe	14
PID 1888 wrote to memory of 616	1888	rundll32.exe	3
PID 1888 wrote to memory of 2904	1888	rundll32.exe	100
PID 1888 wrote to memory of 2904	1888	rundll32.exe	100
PID 1888 wrote to memory of 2904	1888	rundll32.exe	100

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\520d4f89e4d8d362e8ea066f54b242e7.dll,#1
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\hgGyxXrQ.dll,a
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2904

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\520d4f89e4d8d362e8ea066f54b242e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hgGyxXrQ.dll

Filesize
24KB

MD5
520d4f89e4d8d362e8ea066f54b242e7

SHA1
c738ec2dfc13192bb185eb8afe6719c11c8f4a95

SHA256
96b09dbac459eaedab6b4648068d1f9c73bb769678ac3981a8544f8d5d014b0f

SHA512
973006c65ee9ad77dac0d93245705be714b683b3b552fe5fdb5c66a3b7dc7a0af579fab947344724cb4d442d418d81acedae1188dfeb9d0043f796e8b7dd9f9d

Download Submit
memory/1888-3-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1888-11-0x0000000002960000-0x0000000002978000-memory.dmp

Filesize
96KB

Download
memory/1888-10-0x0000000002960000-0x0000000002978000-memory.dmp

Filesize
96KB

Download
memory/1888-2-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1888-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1888-0-0x00000000028F0000-0x00000000028F5000-memory.dmp

Filesize
20KB

Download
memory/1888-14-0x00000000028F0000-0x00000000028F5000-memory.dmp

Filesize
20KB

Download
memory/1888-17-0x0000000002980000-0x0000000002985000-memory.dmp

Filesize
20KB

Download
memory/2904-22-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2904-21-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download