Analysis
-
max time kernel
598s -
max time network
601s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll
Resource
win10-20231215-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll
Resource
win11-20231215-en
windows11-21h2-x64
General
-
Target
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll
-
Size
59KB
-
MD5
128f2c45abb340712b5bdb9787664877
-
SHA1
e49dc6a12c76c9adf7a66e753b835fcd1cb48083
-
SHA256
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf
-
SHA512
6a2a4a1c4a5cc6ca2155ffd7f8849e73dba149e3b32beec13a37e68295f5f384195f7fc88eb2d4f1c3692ed3e4230b0383630842a8950b636e6a21806553fc70
-
SSDEEP
768:xiC/DyfvDF9JN1O7zub7+IJSuCMajTiAmPbjQLMf8shs1Fw9Dy:oC/DivXkOJSuwjFmz0Lchs1FAG
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 46 2656 rundll32.exe 48 2656 rundll32.exe 51 2656 rundll32.exe 52 2656 rundll32.exe 53 2656 rundll32.exe 54 2656 rundll32.exe 55 2656 rundll32.exe 56 2656 rundll32.exe 57 2656 rundll32.exe 58 2656 rundll32.exe 59 2656 rundll32.exe 60 2656 rundll32.exe 61 2656 rundll32.exe 62 2656 rundll32.exe 63 2656 rundll32.exe 64 2656 rundll32.exe 65 2656 rundll32.exe 66 2656 rundll32.exe 67 2656 rundll32.exe 68 2656 rundll32.exe 69 2656 rundll32.exe 70 2656 rundll32.exe 71 2656 rundll32.exe 72 2656 rundll32.exe 73 2656 rundll32.exe 74 2656 rundll32.exe 75 2656 rundll32.exe 76 2656 rundll32.exe 77 2656 rundll32.exe 78 2656 rundll32.exe 79 2656 rundll32.exe 80 2656 rundll32.exe 81 2656 rundll32.exe 82 2656 rundll32.exe 83 2656 rundll32.exe 84 2656 rundll32.exe 85 2656 rundll32.exe 86 2656 rundll32.exe 87 2656 rundll32.exe 88 2656 rundll32.exe 89 2656 rundll32.exe 90 2656 rundll32.exe 91 2656 rundll32.exe 94 2656 rundll32.exe 96 2656 rundll32.exe 97 2656 rundll32.exe 99 2656 rundll32.exe 100 2656 rundll32.exe 101 2656 rundll32.exe 102 2656 rundll32.exe 103 2656 rundll32.exe 104 2656 rundll32.exe 105 2656 rundll32.exe 106 2656 rundll32.exe 107 2656 rundll32.exe 108 2656 rundll32.exe 109 2656 rundll32.exe 110 2656 rundll32.exe 111 2656 rundll32.exe 112 2656 rundll32.exe 113 2656 rundll32.exe 114 2656 rundll32.exe 115 2656 rundll32.exe 116 2656 rundll32.exe -
Deletes itself 1 IoCs
pid Process 4336 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 2656 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4336 rundll32.exe 4336 rundll32.exe 4336 rundll32.exe 4336 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4336 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4336 wrote to memory of 2656 4336 rundll32.exe 84 PID 4336 wrote to memory of 2656 4336 rundll32.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll,#11⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_a9653914.dll", #12⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5128f2c45abb340712b5bdb9787664877
SHA1e49dc6a12c76c9adf7a66e753b835fcd1cb48083
SHA25672db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf
SHA5126a2a4a1c4a5cc6ca2155ffd7f8849e73dba149e3b32beec13a37e68295f5f384195f7fc88eb2d4f1c3692ed3e4230b0383630842a8950b636e6a21806553fc70