Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2024 19:45
Static task
static1
Behavioral task
behavioral1
Sample
4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll
Resource
win10v2004-20231215-en
General
-
Target
4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll
-
Size
339KB
-
MD5
a7c4c1c4fabf6dc0f5702f73083f3e46
-
SHA1
99a705d77e1e442e04963e6295aa15b24e9c4db5
-
SHA256
4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2
-
SHA512
0379170d8b772bf3ab4a8292fbb136b5ab49b7b961175ebe77884e8c1b700643c9566b9b1da6e45945cf3f642dc13eed58ed318cdc6751cbc2942888fd989144
-
SSDEEP
6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBkA:PbtYapX0yrXA
Malware Config
Signatures
-
Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{852DA730-963F-41EA-63FB-FC952FB741DA} rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2FC841DA-30D9-EB84-0DA6-963FC952EB74} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2FC841DA-30D9-EB84-0DA6-963FC952EB74}\ rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\WRMW.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\WRMW.dll rundll32.exe File created C:\Windows\SysWOW64\CXSB.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\CXSB.dll rundll32.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{852DA730-963F-41EA-63FB-FC952FB741DA}\InprocServer32\ = "C:\\Windows\\SysWow64\\CXSB.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FC841DA-30D9-EB84-0DA6-963FC952EB74}\ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FC841DA-30D9-EB84-0DA6-963FC952EB74}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FC841DA-30D9-EB84-0DA6-963FC952EB74}\InprocServer32\ = "C:\\Windows\\SysWow64\\WRMW.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{852DA730-963F-41EA-63FB-FC952FB741DA} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{852DA730-963F-41EA-63FB-FC952FB741DA}\ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FC841DA-30D9-EB84-0DA6-963FC952EB74} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FC841DA-30D9-EB84-0DA6-963FC952EB74}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{852DA730-963F-41EA-63FB-FC952FB741DA}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{852DA730-963F-41EA-63FB-FC952FB741DA}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2244 wrote to memory of 4332 2244 rundll32.exe 85 PID 2244 wrote to memory of 4332 2244 rundll32.exe 85 PID 2244 wrote to memory of 4332 2244 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll,#12⤵
- Modifies Shared Task Scheduler registry keys
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
PID:4332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339KB
MD5d68d219b607eefc8bfe7fc6dbfca9b3c
SHA16a364f40df329f80c6107ec207ff41722198d0c8
SHA256c1dfe969a71f81c5d87ab700e28413fb0cb30d30d15d65c242dbd50c1b772ebf
SHA51289f7c9fc6282c6d848cb4a062c4afc872c6bc33a166bb3eed6196d24965a7fbf4441f4f2e6b739526c013eee5a9e8a0da912f5cf2272499803b71152a92a65b2