Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
17-02-2024 04:56
Behavioral task
behavioral1
Sample
fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll
Resource
win10v2004-20231215-en
General
-
Target
fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll
-
Size
3.8MB
-
MD5
8de49100b064dfce5ae0403ff6c72517
-
SHA1
281c595207a0046e95985a48f533931651a82f57
-
SHA256
fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68
-
SHA512
ff0ed7763a73a3cb9d5e05c6bf676a382ee9cf2d69d9cfaeb4d247381bb79789cd9121bb43d527374848c037bce6124ebfd0b3c9cd588f7712cf597572c8e1f7
-
SSDEEP
98304:8l7UGD5GK1yNEdVMzN4moGbiwTswBnSY1:8l3D5GnEd+zN4moGWGRSY1
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 17 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2536 wrote to memory of 2384 2536 rundll32.exe rundll32.exe PID 2536 wrote to memory of 2384 2536 rundll32.exe rundll32.exe PID 2536 wrote to memory of 2384 2536 rundll32.exe rundll32.exe PID 2536 wrote to memory of 2384 2536 rundll32.exe rundll32.exe PID 2536 wrote to memory of 2384 2536 rundll32.exe rundll32.exe PID 2536 wrote to memory of 2384 2536 rundll32.exe rundll32.exe PID 2536 wrote to memory of 2384 2536 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll,#12⤵
- Checks processor information in registry
PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2384-0-0x0000000002290000-0x000000000266F000-memory.dmpFilesize
3.9MB
-
memory/2384-8-0x0000000002CD0000-0x00000000034DA000-memory.dmpFilesize
8.0MB
-
memory/2384-9-0x0000000002CD0000-0x00000000034DA000-memory.dmpFilesize
8.0MB
-
memory/2384-10-0x0000000002CD0000-0x00000000034DA000-memory.dmpFilesize
8.0MB
-
memory/2384-11-0x0000000002CD0000-0x00000000034DA000-memory.dmpFilesize
8.0MB