7bfb91c11d408ae45c072a89658239ad1322b07ffdfccb696aed692e388f53ca

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c921dda11e162fb8cb092e269f0d99c3.exe
Size

113KB
MD5

c921dda11e162fb8cb092e269f0d99c3
SHA1

60974c863ca630e8ec238e70110d360f0b1fb3e0
SHA256

7bfb91c11d408ae45c072a89658239ad1322b07ffdfccb696aed692e388f53ca
SHA512

f9571f8ac7ee6e0ebf003eb7b0c3533963287142eb5b5eb314e1acd64dc19a6e6092d3f400bb4c4a1d93faf1bf9d7e9671962ffdf277bf28701c674cf16939ae
SSDEEP

1536:Iqs9zlRug86/5yUJt38LkbqhVQI5gFaPtgKMeR5V3zXAMUJuo63w+tl:I/PRW6/5yU/84MBQa2nePV3zQgA8l

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Loads dropped DLL 4 IoCs

pid	Process
3000	rundll32.exe
3000	rundll32.exe
3000	rundll32.exe
3000	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vawanuh = "Rundll32.exe \"C:\\Windows\\system32\\rafuyim.dll\" s"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wipunit.dll	c921dda11e162fb8cb092e269f0d99c3.exe
File opened for modification	C:\Windows\SysWOW64\rafuyim.dll	c921dda11e162fb8cb092e269f0d99c3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3000	rundll32.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2368	c921dda11e162fb8cb092e269f0d99c3.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3000	2368	c921dda11e162fb8cb092e269f0d99c3.exe	29
PID 2368 wrote to memory of 3000	2368	c921dda11e162fb8cb092e269f0d99c3.exe	29
PID 2368 wrote to memory of 3000	2368	c921dda11e162fb8cb092e269f0d99c3.exe	29
PID 2368 wrote to memory of 3000	2368	c921dda11e162fb8cb092e269f0d99c3.exe	29
PID 2368 wrote to memory of 3000	2368	c921dda11e162fb8cb092e269f0d99c3.exe	29
PID 2368 wrote to memory of 3000	2368	c921dda11e162fb8cb092e269f0d99c3.exe	29
PID 2368 wrote to memory of 3000	2368	c921dda11e162fb8cb092e269f0d99c3.exe	29

C:\Users\Admin\AppData\Local\Temp\c921dda11e162fb8cb092e269f0d99c3.exe
"C:\Users\Admin\AppData\Local\Temp\c921dda11e162fb8cb092e269f0d99c3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 "C:\Windows\system32\rafuyim.dll" s
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rafuyim.dll

Filesize
113KB

MD5
c276b21b75b9f1a252cf41046a623fa4

SHA1
3d1ba53533116dd81a6e9d237271195b9f15de36

SHA256
38b4ca7308b22198fd86d956cc948d4882cafb9c82ea7a231ec6d09a8ca8e7b5

SHA512
fcd4a5f07950e0662d0ede13f0aff5e35d99413e6811876d28be2591c5a10bfec1c474792a46ee5536d68421265370b0184bce6d91fc7f9b432da16ea18e4f31

Download Submit
memory/2368-0-0x00000000003A0000-0x00000000003C3000-memory.dmp

Filesize
140KB

Download
memory/2368-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2368-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3000-9-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/3000-11-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download
memory/3000-10-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download
memory/3000-14-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download
memory/3000-13-0x0000000000250000-0x0000000000273000-memory.dmp

Filesize
140KB

Download
memory/3000-15-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download
memory/3000-12-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/3000-16-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads