Analysis

  • max time kernel
    142s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-03-2024 19:45

General

  • Target

    4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll

  • Size

    339KB

  • MD5

    a7c4c1c4fabf6dc0f5702f73083f3e46

  • SHA1

    99a705d77e1e442e04963e6295aa15b24e9c4db5

  • SHA256

    4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2

  • SHA512

    0379170d8b772bf3ab4a8292fbb136b5ab49b7b961175ebe77884e8c1b700643c9566b9b1da6e45945cf3f642dc13eed58ed318cdc6751cbc2942888fd989144

  • SSDEEP

    6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBkA:PbtYapX0yrXA

Malware Config

Signatures

  • Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll,#1
      2⤵
      • Modifies Shared Task Scheduler registry keys
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Modifies registry class
      PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\NOOP.dll

    Filesize

    339KB

    MD5

    78f82703c28efdb3a11c140b987557dc

    SHA1

    82e6ca3c2b56f5132943f8c4f491aecda64276aa

    SHA256

    074f60a48f770aae040277f84995fa9d10cf45002baf4641d1a3ed52dc4d6daf

    SHA512

    db31097d3cb172ff1905ca54637d5082291ebf0cda27b770b8a476545a428934cf3338f5e18a1e66ffa21b93fe4e8df394aa0f98026948ecc0790f51332eb661

  • memory/2944-15-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-14-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-10-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-11-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-16-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-13-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-1-0x0000000077BF0000-0x0000000077BF1000-memory.dmp

    Filesize

    4KB

  • memory/2944-0-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-12-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-17-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-18-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-19-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-20-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-21-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-22-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB

  • memory/2944-23-0x0000000000160000-0x00000000001BC000-memory.dmp

    Filesize

    368KB