Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 00:47
Static task
static1
Behavioral task
behavioral1
Sample
f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae.dll
Resource
win7-20240221-en
General
-
Target
f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae.dll
-
Size
2.6MB
-
MD5
a7ca6e19d542ff70f54e146cb0d93d79
-
SHA1
3b9b420e4f60914caeabf7a273346996f66e5c93
-
SHA256
f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae
-
SHA512
f0b73ed2c3d2188b3daf519147c4383d84a2d1c36be5a9512f4c32897ba70d3c6b6f2a29f29a494a76cb66cb1fff08d7d64ad273f50e3f37a8a9569287b85de5
-
SSDEEP
49152:+IUtVDYhD+MnjnTe8fgFoTp/kzg8YTys4EB15pthr8yD73j96Ae:zUDU/jnTecRVeg8DjEB1/zvDX96
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/320-7-0x0000000000210000-0x0000000000246000-memory.dmp UPX behavioral1/files/0x000c00000001222a-6.dat UPX behavioral1/memory/2548-18-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2548-11-0x0000000000400000-0x0000000000436000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 2548 rundll32Srv.exe -
Loads dropped DLL 1 IoCs
pid Process 320 rundll32.exe -
resource yara_rule behavioral1/memory/320-7-0x0000000000210000-0x0000000000246000-memory.dmp upx behavioral1/files/0x000c00000001222a-6.dat upx behavioral1/memory/2548-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2548-11-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px60A6.tmp rundll32Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2548 rundll32Srv.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
pid Process 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe 2548 rundll32Srv.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2548 rundll32Srv.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 320 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 320 2748 rundll32.exe 28 PID 2748 wrote to memory of 320 2748 rundll32.exe 28 PID 2748 wrote to memory of 320 2748 rundll32.exe 28 PID 2748 wrote to memory of 320 2748 rundll32.exe 28 PID 2748 wrote to memory of 320 2748 rundll32.exe 28 PID 2748 wrote to memory of 320 2748 rundll32.exe 28 PID 2748 wrote to memory of 320 2748 rundll32.exe 28 PID 320 wrote to memory of 2548 320 rundll32.exe 29 PID 320 wrote to memory of 2548 320 rundll32.exe 29 PID 320 wrote to memory of 2548 320 rundll32.exe 29 PID 320 wrote to memory of 2548 320 rundll32.exe 29 PID 2548 wrote to memory of 372 2548 rundll32Srv.exe 3 PID 2548 wrote to memory of 372 2548 rundll32Srv.exe 3 PID 2548 wrote to memory of 372 2548 rundll32Srv.exe 3 PID 2548 wrote to memory of 372 2548 rundll32Srv.exe 3 PID 2548 wrote to memory of 372 2548 rundll32Srv.exe 3 PID 2548 wrote to memory of 372 2548 rundll32Srv.exe 3 PID 2548 wrote to memory of 372 2548 rundll32Srv.exe 3 PID 2548 wrote to memory of 380 2548 rundll32Srv.exe 4 PID 2548 wrote to memory of 380 2548 rundll32Srv.exe 4 PID 2548 wrote to memory of 380 2548 rundll32Srv.exe 4 PID 2548 wrote to memory of 380 2548 rundll32Srv.exe 4 PID 2548 wrote to memory of 380 2548 rundll32Srv.exe 4 PID 2548 wrote to memory of 380 2548 rundll32Srv.exe 4 PID 2548 wrote to memory of 380 2548 rundll32Srv.exe 4 PID 2548 wrote to memory of 420 2548 rundll32Srv.exe 5 PID 2548 wrote to memory of 420 2548 rundll32Srv.exe 5 PID 2548 wrote to memory of 420 2548 rundll32Srv.exe 5 PID 2548 wrote to memory of 420 2548 rundll32Srv.exe 5 PID 2548 wrote to memory of 420 2548 rundll32Srv.exe 5 PID 2548 wrote to memory of 420 2548 rundll32Srv.exe 5 PID 2548 wrote to memory of 420 2548 rundll32Srv.exe 5 PID 2548 wrote to memory of 464 2548 rundll32Srv.exe 6 PID 2548 wrote to memory of 464 2548 rundll32Srv.exe 6 PID 2548 wrote to memory of 464 2548 rundll32Srv.exe 6 PID 2548 wrote to memory of 464 2548 rundll32Srv.exe 6 PID 2548 wrote to memory of 464 2548 rundll32Srv.exe 6 PID 2548 wrote to memory of 464 2548 rundll32Srv.exe 6 PID 2548 wrote to memory of 464 2548 rundll32Srv.exe 6 PID 2548 wrote to memory of 480 2548 rundll32Srv.exe 7 PID 2548 wrote to memory of 480 2548 rundll32Srv.exe 7 PID 2548 wrote to memory of 480 2548 rundll32Srv.exe 7 PID 2548 wrote to memory of 480 2548 rundll32Srv.exe 7 PID 2548 wrote to memory of 480 2548 rundll32Srv.exe 7 PID 2548 wrote to memory of 480 2548 rundll32Srv.exe 7 PID 2548 wrote to memory of 480 2548 rundll32Srv.exe 7 PID 2548 wrote to memory of 488 2548 rundll32Srv.exe 8 PID 2548 wrote to memory of 488 2548 rundll32Srv.exe 8 PID 2548 wrote to memory of 488 2548 rundll32Srv.exe 8 PID 2548 wrote to memory of 488 2548 rundll32Srv.exe 8 PID 2548 wrote to memory of 488 2548 rundll32Srv.exe 8 PID 2548 wrote to memory of 488 2548 rundll32Srv.exe 8 PID 2548 wrote to memory of 488 2548 rundll32Srv.exe 8 PID 2548 wrote to memory of 600 2548 rundll32Srv.exe 9 PID 2548 wrote to memory of 600 2548 rundll32Srv.exe 9 PID 2548 wrote to memory of 600 2548 rundll32Srv.exe 9 PID 2548 wrote to memory of 600 2548 rundll32Srv.exe 9 PID 2548 wrote to memory of 600 2548 rundll32Srv.exe 9 PID 2548 wrote to memory of 600 2548 rundll32Srv.exe 9 PID 2548 wrote to memory of 600 2548 rundll32Srv.exe 9 PID 2548 wrote to memory of 684 2548 rundll32Srv.exe 10 PID 2548 wrote to memory of 684 2548 rundll32Srv.exe 10 PID 2548 wrote to memory of 684 2548 rundll32Srv.exe 10 PID 2548 wrote to memory of 684 2548 rundll32Srv.exe 10
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:600
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:764
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:684
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:768
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:816
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1188
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:844
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:968
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:276
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:908
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1080
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1112
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2064
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2352
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:480
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\rundll32Srv.exeC:\Windows\SysWOW64\rundll32Srv.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5d105024666fce5e3ea84b1ad32c80fc6
SHA10114a2a0a254fe477c7a01274ed4b11f88b9d425
SHA256e9f7abdabf7c1e1e597cb402ebaab5033a481e54b917095032486e7d825bb151
SHA512ecf42cba45e36dfa921de688f27e1f411b503ad8d9555e58ae230fc1a266f18fed9a2454e8870b84f79ee6edfe67fbd99cb7973ab5296c3a8fc97e4f6f913a11