Analysis

  • max time kernel
    137s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 16:43

General

  • Target

    setordinal.dll

  • Size

    798KB

  • MD5

    98fbaff7bb8c06503ea8bc14cb1c8427

  • SHA1

    a6feec5c9227a1bf3d02afdad2b7a766900dbcb7

  • SHA256

    43b63fdd1a3e68c641201e1ddc2d8adff31cbc7ea573c26e831de3cfcc3bc818

  • SHA512

    65155e8ebb7fcb8316b73842d09772ccc220d660d136e633991b174b9887fe80e0c7dacbd413d2e4ed2dd730159ea1ea0ca8543b4de8ff1b38ad9176bc3979c9

  • SSDEEP

    12288:q/cSVrV6nK0AtRTxsdzvbFbkag0UvMzK4NWJFgVgU5Sz9duW/TC6vhWDsghGdQxI:kcS1V6injBdQx3VcNNW8QO

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\setordinal.dll,#1
    1⤵
    • Deletes itself
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_765773b8.dll", #1
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Custom_update\Update_765773b8.dll

    Filesize

    798KB

    MD5

    98fbaff7bb8c06503ea8bc14cb1c8427

    SHA1

    a6feec5c9227a1bf3d02afdad2b7a766900dbcb7

    SHA256

    43b63fdd1a3e68c641201e1ddc2d8adff31cbc7ea573c26e831de3cfcc3bc818

    SHA512

    65155e8ebb7fcb8316b73842d09772ccc220d660d136e633991b174b9887fe80e0c7dacbd413d2e4ed2dd730159ea1ea0ca8543b4de8ff1b38ad9176bc3979c9

  • memory/488-6-0x000001A947F00000-0x000001A947F13000-memory.dmp

    Filesize

    76KB

  • memory/488-7-0x000001A947F00000-0x000001A947F13000-memory.dmp

    Filesize

    76KB

  • memory/3724-0-0x0000027A2A470000-0x0000027A2A483000-memory.dmp

    Filesize

    76KB

  • memory/3724-5-0x0000027A2A470000-0x0000027A2A483000-memory.dmp

    Filesize

    76KB

  • memory/3724-2-0x0000000180000000-0x00000001800CD000-memory.dmp

    Filesize

    820KB