2cab6c4426e4acf84083c30440f5063dc36e72b6c2106434c9f3ba9f5679b514

Analysis

max time kernel
160s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5439d80cd34b60583820934503ecf7b.exe
Size

591KB
MD5

d5439d80cd34b60583820934503ecf7b
SHA1

3ddae9d758eecedbd6210672636c1ddbf932e8de
SHA256

2cab6c4426e4acf84083c30440f5063dc36e72b6c2106434c9f3ba9f5679b514
SHA512

3f95f72f9c3363c8bc5b331c8f81b516277628943736454d560444f5ec8b10765cb36c3bd797bbdd8286f69be6aa3499e2e196012ace8a32241321b648a9fac8
SSDEEP

12288:n5fWAhZJTuTL2ts+RrUY9OQbJOCY+31acxpDIN48Rkk/t:5+mZxQ2t1RdOQdOCPFacjINbk

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
51	4404	rundll32.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
2660	rundll32.exe
2240	rundll32.exe
4404	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\credhelp.dll_xserve = "rundll32.exe \"C:\\Windows\\SysWOW64\\credhelp.dll\",xserve"	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\credhelp.dll	d5439d80cd34b60583820934503ecf7b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe
2240	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 2660	4536	d5439d80cd34b60583820934503ecf7b.exe	100
PID 4536 wrote to memory of 2660	4536	d5439d80cd34b60583820934503ecf7b.exe	100
PID 4536 wrote to memory of 2660	4536	d5439d80cd34b60583820934503ecf7b.exe	100
PID 2660 wrote to memory of 2240	2660	rundll32.exe	102
PID 2660 wrote to memory of 2240	2660	rundll32.exe	102
PID 2660 wrote to memory of 2240	2660	rundll32.exe	102
PID 2660 wrote to memory of 4404	2660	rundll32.exe	103
PID 2660 wrote to memory of 4404	2660	rundll32.exe	103
PID 2660 wrote to memory of 4404	2660	rundll32.exe	103

C:\Users\Admin\AppData\Local\Temp\d5439d80cd34b60583820934503ecf7b.exe
"C:\Users\Admin\AppData\Local\Temp\d5439d80cd34b60583820934503ecf7b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\credhelp.dll",install
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\credhelp.dll",watch
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2240
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\credhelp.dll",xserve
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\credhelp.dll

Filesize
477KB

MD5
60ca76bb69c74518a6cb0f148a4cff58

SHA1
4f0e2c0a89450e9f34d44bd1b48a49a38f4e00ba

SHA256
af1407aaebfc05e244aefd8c3079928b2fb19c1e5525277b33c1975c376510cf

SHA512
c8385dc58fff607398f9b0ace0c5d147b7575600273a7e45e2a7411fdc76699ee68cca0cb439bac9bc31807fdd2263e502ed3c02444d10a3a6e580ef2127a6bd

Download Submit
memory/2240-14-0x00000000009E0000-0x0000000000AE0000-memory.dmp

Filesize
1024KB

Download
memory/2240-31-0x00000000009E0000-0x0000000000AE0000-memory.dmp

Filesize
1024KB

Download
memory/2240-27-0x0000000074C00000-0x0000000074D07000-memory.dmp

Filesize
1.0MB

Download
memory/2660-9-0x0000000000CB0000-0x0000000000DB0000-memory.dmp

Filesize
1024KB

Download
memory/2660-12-0x0000000074C00000-0x0000000074D07000-memory.dmp

Filesize
1.0MB

Download
memory/2660-7-0x0000000074C00000-0x0000000074D07000-memory.dmp

Filesize
1.0MB

Download
memory/4404-23-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download
memory/4404-28-0x0000000074C00000-0x0000000074D07000-memory.dmp

Filesize
1.0MB

Download
memory/4536-6-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4536-0-0x0000000000AD0000-0x0000000000BD0000-memory.dmp

Filesize
1024KB

Download
memory/4536-2-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4536-1-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download