Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
17/01/2024, 20:58
Behavioral task
behavioral1
Sample
6396a01ba4a4862c2f8efed81c940ea9.dll
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6396a01ba4a4862c2f8efed81c940ea9.dll
-
Size
22KB
-
MD5
6396a01ba4a4862c2f8efed81c940ea9
-
SHA1
ec1d9f762cec09437c9f4ecd0b2c94a2f615ab10
-
SHA256
d832a3dffe9094a30b0d866e9b39e934220a36a8e7bc62851916026c42bb4985
-
SHA512
6ce2a0a6d4a1c49567151fa4f46889d378ef64987820866c33ed7050ed755162dd8e30afbb614fdb86517cf0a012b6dfef7e916519362a54e2bd0a8717c968b3
-
SSDEEP
384:A8aE+2FgmxVUnU/4Ty1/XPiAlXMNK8HtD7clNnirvJ0p1+Kf:A8aE/FhUnUUy11XEK8ND7gNn1p1+
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:Enabled:rundll32" rundll32.exe -
resource yara_rule behavioral1/memory/2920-1-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2920-2-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2920-3-0x0000000010000000-0x0000000010041000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rfs.bin rundll32.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2920 2860 rundll32.exe 28 PID 2860 wrote to memory of 2920 2860 rundll32.exe 28 PID 2860 wrote to memory of 2920 2860 rundll32.exe 28 PID 2860 wrote to memory of 2920 2860 rundll32.exe 28 PID 2860 wrote to memory of 2920 2860 rundll32.exe 28 PID 2860 wrote to memory of 2920 2860 rundll32.exe 28 PID 2860 wrote to memory of 2920 2860 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6396a01ba4a4862c2f8efed81c940ea9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6396a01ba4a4862c2f8efed81c940ea9.dll,#12⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: LoadsDriver
PID:2920
-