Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2024 04:06

General

  • Target

    10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll

  • Size

    103KB

  • MD5

    e9f6513c37debcce50e9633aefa757c0

  • SHA1

    e7623d6cb0cf234b9f3e3f8b14f63e2077441a0f

  • SHA256

    10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd

  • SHA512

    de6d502b6bb6d6b46d5b0170db2e3f22f376f5370b6fe6793efbe3ea2207e65033d0b3e0b195b90833ec305bd0decffb6264f2dc973160dbdc330646af242d74

  • SSDEEP

    1536:QzICS4A30TY1kUS/U2ztdS1I6DdL9Ta1lx1411ey2NzPBmdy6h+/:vJ0TYyUS/U2RgGWL9+zx1c1eXNNmdA/

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll,#1
      2⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\ProgramData\6C56.tmp
        "C:\ProgramData\6C56.tmp"
        3⤵
        • Checks computer location settings
        • Deletes itself
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4368
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6C56.tmp >> NUL
          4⤵
            PID:1728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\6C56.tmp

      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

      Filesize

      103KB

      MD5

      c28f828c1a26243b75a777be4f0170db

      SHA1

      cc622f0b01e99c8061bd56966b4e5670c061db6e

      SHA256

      82812c2d102f2aca8ab326cf7a7fad505b2aec5035649e5365eb72c6fd3fc75f

      SHA512

      647ce5e9090706ff265e5be8fcd13d58d11ec0a0488b48833f41edd6e5ef23cf34b28e18b3246cf3a2084d3c79b8ef58edcbbb77d57c19c36ddd25b0d11c1b44

    • memory/760-0-0x0000000002800000-0x0000000002810000-memory.dmp

      Filesize

      64KB

    • memory/760-1-0x0000000002800000-0x0000000002810000-memory.dmp

      Filesize

      64KB

    • memory/760-3-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

      Filesize

      64KB

    • memory/4368-9-0x000000007FE40000-0x000000007FE41000-memory.dmp

      Filesize

      4KB

    • memory/4368-39-0x0000000002640000-0x0000000002650000-memory.dmp

      Filesize

      64KB

    • memory/4368-32-0x0000000002640000-0x0000000002650000-memory.dmp

      Filesize

      64KB

    • memory/4368-41-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

      Filesize

      4KB

    • memory/4368-42-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

      Filesize

      4KB

    • memory/4368-40-0x000000007FE20000-0x000000007FE21000-memory.dmp

      Filesize

      4KB

    • memory/4368-43-0x000000007FE00000-0x000000007FE01000-memory.dmp

      Filesize

      4KB