Malware Analysis Report

2025-03-14 22:31

Sample ID 240304-rkhsvacb4y
Target b255bfb165207c91bc333eadf7dc5191
SHA256 81f8cf0d14c183be6928e42e7ec558fb39bd592b300890037c8ca19c183b5b8e
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

81f8cf0d14c183be6928e42e7ec558fb39bd592b300890037c8ca19c183b5b8e

Threat Level: Shows suspicious behavior

The file b255bfb165207c91bc333eadf7dc5191 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-04 14:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-04 14:15

Reported

2024-03-04 14:17

Platform

win7-20240221-en

Max time kernel

140s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe

"C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 88

Network

N/A

Files

memory/3008-0-0x0000000000400000-0x000000000040E000-memory.dmp

memory/3008-1-0x0000000000220000-0x0000000000225000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-04 14:15

Reported

2024-03-04 14:17

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

117s

Command Line

winlogon.exe

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\wvUkICtr.dll,#1" C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\rqRKAQIc.dll C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe N/A
File created C:\Windows\SysWOW64\rqRKAQIc.dll C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe N/A
File created C:\Windows\SysWOW64\wvUkICtr.dll C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe N/A
File opened for modification C:\Windows\SysWOW64\wvUkICtr.dll C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DE6E729-3CBD-42A2-AE52-C99609B230D4}\InprocServer32\ThreadingModel = "Both" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DE6E729-3CBD-42A2-AE52-C99609B230D4} C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DE6E729-3CBD-42A2-AE52-C99609B230D4}\InprocServer32 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DE6E729-3CBD-42A2-AE52-C99609B230D4}\InprocServer32\ = "C:\\Windows\\SysWow64\\wvUkICtr.dll" C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe N/A

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe

"C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe"

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Windows\system32\wvUkICtr.dll,a

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/1264-0-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1264-1-0x0000000002030000-0x0000000002035000-memory.dmp

C:\Windows\SysWOW64\rqRKAQIc.dll

MD5 6c4faf2bee227999271ce23f74797b93
SHA1 e66aaadfa53ac8dd8646475e4e94a39a44b756b6
SHA256 471190ab85cc3ed0694758a972c54c8795429bc00a25cbe29f64296c2e4ce18d
SHA512 baecb0a57a14918ca50126d29077916ec77602d47a85c41dedfc5796e645d03b97145c24dc523940b8de18fb1bb9ece1dabfe5c57a3a12741919d8151cfdfab8

memory/1264-7-0x0000000010000000-0x0000000010010000-memory.dmp

memory/1264-9-0x0000000002A90000-0x0000000002A95000-memory.dmp

memory/1264-13-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1264-14-0x0000000010000000-0x0000000010010000-memory.dmp

memory/1264-17-0x0000000002030000-0x0000000002035000-memory.dmp

memory/216-23-0x0000000010000000-0x0000000010010000-memory.dmp

memory/216-24-0x0000000002B60000-0x0000000002B65000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\removalfile.bat

MD5 9a7ef09167a6f4433681b94351509043
SHA1 259b1375ed8e84943ca1d42646bb416325c89e12
SHA256 d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7
SHA512 96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

memory/216-26-0x0000000010000000-0x0000000010010000-memory.dmp