Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14-02-2024 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b57bbeb7a77e9ff4256defe7141bab3.dll
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b57bbeb7a77e9ff4256defe7141bab3.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
9b57bbeb7a77e9ff4256defe7141bab3.dll
-
Size
424KB
-
MD5
9b57bbeb7a77e9ff4256defe7141bab3
-
SHA1
3d2adf3e0ebac41aadfd122f119786127ea42e0c
-
SHA256
bb947e54137e56040819eefd51990978b28ac3291fb729447470a67f240be1ad
-
SHA512
d3efd3ddaa265f7e1e5b8cd496738a7a4799ec5f479f87c9cbdfd3177f9085e378891345515a7c26e8802b1a7be8158e72a35e006a24c842e76d73683c3b7f53
-
SSDEEP
6144:i/0z/2rEZgcwPDHTSNT/rANdYdtGinqRfvTqDeFul0Mh5TBWQOX6JHY2DbAV0Zg:007/XwboTzAN2tnqRfCevM7TBw0Z4
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 6 2024 rundll32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\9b57bbeb7a77e9ff4256defe7141bab3.dll = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\9b57bbeb7a77e9ff4256defe7141bab3.dll\",watch" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\9b57bbeb7a77e9ff4256defe7141bab3.dll_xserve = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\9b57bbeb7a77e9ff4256defe7141bab3.dll\",xserve" rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2164 2360 rundll32.exe 28 PID 2360 wrote to memory of 2164 2360 rundll32.exe 28 PID 2360 wrote to memory of 2164 2360 rundll32.exe 28 PID 2360 wrote to memory of 2164 2360 rundll32.exe 28 PID 2360 wrote to memory of 2164 2360 rundll32.exe 28 PID 2360 wrote to memory of 2164 2360 rundll32.exe 28 PID 2360 wrote to memory of 2164 2360 rundll32.exe 28 PID 2164 wrote to memory of 2952 2164 rundll32.exe 29 PID 2164 wrote to memory of 2952 2164 rundll32.exe 29 PID 2164 wrote to memory of 2952 2164 rundll32.exe 29 PID 2164 wrote to memory of 2952 2164 rundll32.exe 29 PID 2164 wrote to memory of 2952 2164 rundll32.exe 29 PID 2164 wrote to memory of 2952 2164 rundll32.exe 29 PID 2164 wrote to memory of 2952 2164 rundll32.exe 29 PID 2164 wrote to memory of 2024 2164 rundll32.exe 30 PID 2164 wrote to memory of 2024 2164 rundll32.exe 30 PID 2164 wrote to memory of 2024 2164 rundll32.exe 30 PID 2164 wrote to memory of 2024 2164 rundll32.exe 30 PID 2164 wrote to memory of 2024 2164 rundll32.exe 30 PID 2164 wrote to memory of 2024 2164 rundll32.exe 30 PID 2164 wrote to memory of 2024 2164 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b57bbeb7a77e9ff4256defe7141bab3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b57bbeb7a77e9ff4256defe7141bab3.dll,#12⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\9b57bbeb7a77e9ff4256defe7141bab3.dll",watch3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\9b57bbeb7a77e9ff4256defe7141bab3.dll",xserve3⤵
- Blocklisted process makes network request
PID:2024
-
-