Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2024 04:56
Behavioral task
behavioral1
Sample
fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll
Resource
win10v2004-20231215-en
General
-
Target
fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll
-
Size
3.8MB
-
MD5
8de49100b064dfce5ae0403ff6c72517
-
SHA1
281c595207a0046e95985a48f533931651a82f57
-
SHA256
fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68
-
SHA512
ff0ed7763a73a3cb9d5e05c6bf676a382ee9cf2d69d9cfaeb4d247381bb79789cd9121bb43d527374848c037bce6124ebfd0b3c9cd588f7712cf597572c8e1f7
-
SSDEEP
98304:8l7UGD5GK1yNEdVMzN4moGbiwTswBnSY1:8l3D5GnEd+zN4moGWGRSY1
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3220 wrote to memory of 544 3220 rundll32.exe rundll32.exe PID 3220 wrote to memory of 544 3220 rundll32.exe rundll32.exe PID 3220 wrote to memory of 544 3220 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll,#12⤵
- Checks processor information in registry
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-0-0x0000000002A60000-0x0000000002E3F000-memory.dmpFilesize
3.9MB
-
memory/544-8-0x0000000003310000-0x0000000003B1A000-memory.dmpFilesize
8.0MB
-
memory/544-9-0x0000000077842000-0x0000000077843000-memory.dmpFilesize
4KB
-
memory/544-10-0x0000000003310000-0x0000000003B1A000-memory.dmpFilesize
8.0MB
-
memory/544-11-0x0000000077842000-0x0000000077843000-memory.dmpFilesize
4KB
-
memory/544-12-0x0000000003310000-0x0000000003B1A000-memory.dmpFilesize
8.0MB