Analysis Overview
SHA256
e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc
Threat Level: Known bad
The file e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc was found to be: Known bad.
Malicious Activity Summary
Detect Ducktail Third Stage Payload
Ducktail family
Loads dropped DLL
Checks computer location settings
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-02-28 01:48
Signatures
Detect Ducktail Third Stage Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Ducktail family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-02-28 01:47
Reported
2024-02-28 01:51
Platform
win7-20240221-en
Max time kernel
151s
Max time network
132s
Command Line
Signatures
Loads dropped DLL
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe
"C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe"
Network
| Country | Destination | Domain | Proto |
| US | 154.12.235.50:1516 | 154.12.235.50 | tcp |
| US | 154.12.235.50:1517 | 154.12.235.50 | tcp |
Files
\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\coreclr.dll
| MD5 | 28eb36702cbb0258f749ec78b37d5d8e |
| SHA1 | 420e464b779eb73fe65e4ce77e6a5d95bff894ed |
| SHA256 | 6884784e25299747f5c2e2ab52cdd45872058b548fa9d3555bb501336a26530c |
| SHA512 | b62541fe82c1772358686eeebd110ca5387878cfaa876bb07a15dba7e97d2ef1cd8ae663c670cc7d9d0e39bdcd80041e078fb05ea4dc4a893d83b30dd65654b9 |
memory/1212-12-0x000006448A000000-0x000006448A8F5000-memory.dmp
memory/1212-15-0x000007FEF62D0000-0x000007FEF67DF000-memory.dmp
\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrjit.dll
| MD5 | b2eb7b51bd58201cf498e83846e90110 |
| SHA1 | ca439759b5c5162e626d2b84ab55b93adc552e06 |
| SHA256 | 180557694842854789457a872df849b2130098a9c2bfd70d201f77bec6f9fddb |
| SHA512 | 1a92064b3417b287246fadd88fea9138dfcc659283e063aab9305e424feac0d1b2c216be5f65ce7a95f0322ab3849478892ae407399aa6029a504c4c8a5884da |
memory/1212-18-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-20-0x00000000003B0000-0x00000000003BA000-memory.dmp
memory/1212-22-0x0000000001D50000-0x0000000001D6B000-memory.dmp
memory/1212-25-0x00000000021F0000-0x0000000002233000-memory.dmp
memory/1212-28-0x00000000003A0000-0x00000000003B0000-memory.dmp
memory/1212-31-0x0000000002770000-0x00000000027B6000-memory.dmp
memory/1212-34-0x00000000003C0000-0x00000000003C8000-memory.dmp
memory/1212-37-0x0000000000680000-0x000000000068C000-memory.dmp
memory/1212-40-0x00000000027C0000-0x00000000027ED000-memory.dmp
memory/1212-43-0x00000000036E0000-0x0000000003795000-memory.dmp
memory/1212-46-0x0000000000660000-0x0000000000679000-memory.dmp
memory/1212-49-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-51-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-50-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-52-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-56-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-57-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-55-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-54-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-53-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-58-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-60-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-59-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-64-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-65-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-66-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-63-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-62-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-61-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-68-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-69-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-70-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-71-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-67-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-73-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-72-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-76-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-77-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-75-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-74-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-78-0x0000000003200000-0x00000000036DE000-memory.dmp
memory/1212-1645-0x000007FEF62D0000-0x000007FEF67DF000-memory.dmp
memory/1212-2822-0x0000000000690000-0x0000000000691000-memory.dmp
\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrcompression.dll
| MD5 | 2796467ae763a705b2ef39ea66647716 |
| SHA1 | d83c3b872d5834e8c8bb2b7b5ed7f7858efc7d7d |
| SHA256 | b0ee0e2f69a772001e65830ef106db8563943e69a5684fddd4a9135b3fec0760 |
| SHA512 | 06302947e2681018a0e66efcaa73052ea24c488e228d2775273f6c32efbcb8758c0ada3e60afcce3dcb2e5cd0e3b817d878b91150dca44d644611624dfb4001a |
memory/1212-2912-0x0000000005A60000-0x0000000005AE0000-memory.dmp
memory/1212-2978-0x0000000005A60000-0x0000000005AE0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-02-28 01:47
Reported
2024-02-28 01:51
Platform
win10v2004-20240226-en
Max time kernel
151s
Max time network
151s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe | N/A |
Loads dropped DLL
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe
"C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 154.12.235.50:1516 | 154.12.235.50 | tcp |
| US | 154.12.235.50:1517 | 154.12.235.50 | tcp |
| US | 8.8.8.8:53 | 50.235.12.154.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.65.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\coreclr.dll
| MD5 | 1c434dc8cb09095640c776385ba69691 |
| SHA1 | 97fe8e25bebfb7d790768175a4625d07f3d4abfd |
| SHA256 | 3b3558c408c57be332c9595624f6d49413fe0dd43d3d5fa4626041851f77216a |
| SHA512 | 4bdb7c0e8571422927fbc8eec6d05959915748acce035fef336b32381922a0a54f029f959fb66cb96a89a024c11e2b94ee6948f618dd04d9ae87cc83f3f83ec8 |
memory/4724-12-0x000006448A000000-0x000006448A8F5000-memory.dmp
memory/4724-17-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-18-0x00007FF9FAEF0000-0x00007FF9FB3FF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrjit.dll
| MD5 | b2eb7b51bd58201cf498e83846e90110 |
| SHA1 | ca439759b5c5162e626d2b84ab55b93adc552e06 |
| SHA256 | 180557694842854789457a872df849b2130098a9c2bfd70d201f77bec6f9fddb |
| SHA512 | 1a92064b3417b287246fadd88fea9138dfcc659283e063aab9305e424feac0d1b2c216be5f65ce7a95f0322ab3849478892ae407399aa6029a504c4c8a5884da |
memory/4724-20-0x000001AA317F0000-0x000001AA317FA000-memory.dmp
memory/4724-22-0x000001AA31830000-0x000001AA3184B000-memory.dmp
memory/4724-25-0x000001AA51D90000-0x000001AA51DD3000-memory.dmp
memory/4724-28-0x000001AA317E0000-0x000001AA317F0000-memory.dmp
memory/4724-31-0x000001AA51D40000-0x000001AA51D86000-memory.dmp
memory/4724-34-0x000001AA31820000-0x000001AA31828000-memory.dmp
memory/4724-37-0x000001AA31860000-0x000001AA3186C000-memory.dmp
memory/4724-40-0x000001AA53BF0000-0x000001AA53C1D000-memory.dmp
memory/4724-43-0x000001AA53CE0000-0x000001AA53D95000-memory.dmp
memory/4724-46-0x000001AA31800000-0x000001AA31819000-memory.dmp
memory/4724-50-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-51-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-52-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-53-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-54-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-49-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-55-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-56-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-57-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-58-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-59-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-60-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-62-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-61-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-63-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-64-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-65-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-67-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-66-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-69-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-68-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-70-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-72-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-71-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-73-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-74-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-75-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-76-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-78-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-77-0x0000000000400000-0x00000000008DE000-memory.dmp
memory/4724-2005-0x00007FF9FAEF0000-0x00007FF9FB3FF000-memory.dmp
memory/4724-2830-0x000001AA315B0000-0x000001AA315B1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrcompression.dll
| MD5 | 2796467ae763a705b2ef39ea66647716 |
| SHA1 | d83c3b872d5834e8c8bb2b7b5ed7f7858efc7d7d |
| SHA256 | b0ee0e2f69a772001e65830ef106db8563943e69a5684fddd4a9135b3fec0760 |
| SHA512 | 06302947e2681018a0e66efcaa73052ea24c488e228d2775273f6c32efbcb8758c0ada3e60afcce3dcb2e5cd0e3b817d878b91150dca44d644611624dfb4001a |
memory/4724-2912-0x000001AA55E20000-0x000001AA55E30000-memory.dmp
memory/4724-2975-0x000001AA55E20000-0x000001AA55E30000-memory.dmp