3510acfd881aad5a740a933a96458f9147722b184c9970edfb86fc34a9bfe7ef

General

Target

de4773f30616c5683f88a1b19439a27e.dll
Size

452KB
MD5

de4773f30616c5683f88a1b19439a27e
SHA1

8b2af25ff00674dffa1b82cef490b5b4b2ee1c6a
SHA256

3510acfd881aad5a740a933a96458f9147722b184c9970edfb86fc34a9bfe7ef
SHA512

6fa9147c3f41f5d6481cb501aeb76e528ef6ad6104fc559080e227c14b0f9c467af4fefe693fa09f52faf8dba5920fdef75f1d3688008d8bede6bbf804d0f45c
SSDEEP

12288:CLgUAsuFz4B3Nd6ykj49cemR9yl3rx7KY:c3nE+3iyXcemRMhx7

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
7	2608	rundll32.exe
8	2608	rundll32.exe
9	2608	rundll32.exe
10	2608	rundll32.exe
11	2608	rundll32.exe
12	2608	rundll32.exe

Deletes itself 1 IoCs

pid	Process
568	cmd.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe

Themida packer 29 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2720-0-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2720-1-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2720-2-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2720-3-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2720-4-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/files/0x0024000000015c3c-10.dat	themida
behavioral1/memory/2608-15-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-16-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-17-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-19-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-18-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2720-28-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-32-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-33-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-34-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-36-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-37-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-39-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-41-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-43-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-45-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-47-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-49-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-51-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-53-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-55-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-57-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-59-0x0000000010000000-0x0000000010127000-memory.dmp	themida
behavioral1/memory/2608-61-0x0000000010000000-0x0000000010127000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDLL (sdfdfsd34.exe) = "rundll32.exe C:\\Windows\\system32\\sdfdfsd34.exe,start"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sdfdfsd34.exe	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sdfdfsd34.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2720	rundll32.exe
2608	rundll32.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2720 wrote to memory of 2608	2720	rundll32.exe	29
PID 2720 wrote to memory of 2608	2720	rundll32.exe	29
PID 2720 wrote to memory of 2608	2720	rundll32.exe	29
PID 2720 wrote to memory of 2608	2720	rundll32.exe	29
PID 2720 wrote to memory of 2608	2720	rundll32.exe	29
PID 2720 wrote to memory of 2608	2720	rundll32.exe	29
PID 2720 wrote to memory of 2608	2720	rundll32.exe	29
PID 2720 wrote to memory of 568	2720	rundll32.exe	30
PID 2720 wrote to memory of 568	2720	rundll32.exe	30
PID 2720 wrote to memory of 568	2720	rundll32.exe	30
PID 2720 wrote to memory of 568	2720	rundll32.exe	30
PID 2720 wrote to memory of 568	2720	rundll32.exe	30
PID 2720 wrote to memory of 568	2720	rundll32.exe	30
PID 2720 wrote to memory of 568	2720	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de4773f30616c5683f88a1b19439a27e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de4773f30616c5683f88a1b19439a27e.dll,#1
  2⤵
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Windows\system32\sdfdfsd34.exe,start
    3⤵
    - Blocklisted process makes network request
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\uninstall.bat" "
    3⤵
    - Deletes itself
    PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uninstall.bat

Filesize
238B

MD5
9495e3d21811320ddf078ec7f084c0ec

SHA1
a34770370c2248b27bf1af3f3cb8f27d16117336

SHA256
23307d859e39a1f307ceba969c00c451d1993983f6aa360a0909530521aebfab

SHA512
b7787ba1a9c4b292f176ac73b64c5b6c06d5c76e0577ccb369ae6f38c1ec0ee77b2654a177821841d3f6bb28bccd50f4b04036ce146484d4d1655b64e15813e9

Download Submit
C:\Windows\SysWOW64\sdfdfsd34.exe

Filesize
452KB

MD5
de4773f30616c5683f88a1b19439a27e

SHA1
8b2af25ff00674dffa1b82cef490b5b4b2ee1c6a

SHA256
3510acfd881aad5a740a933a96458f9147722b184c9970edfb86fc34a9bfe7ef

SHA512
6fa9147c3f41f5d6481cb501aeb76e528ef6ad6104fc559080e227c14b0f9c467af4fefe693fa09f52faf8dba5920fdef75f1d3688008d8bede6bbf804d0f45c

Download Submit
memory/2608-29-0x0000000000820000-0x0000000000822000-memory.dmp

Filesize
8KB

Download
memory/2608-33-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-61-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-59-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-57-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-55-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-15-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-16-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-17-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-19-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-18-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-53-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-51-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-49-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-47-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-31-0x0000000000FA0000-0x0000000000FAE000-memory.dmp

Filesize
56KB

Download
memory/2608-45-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-34-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-32-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-36-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-37-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-39-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-41-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2608-43-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2720-3-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2720-0-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2720-28-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2720-27-0x0000000000FA0000-0x0000000000FAE000-memory.dmp

Filesize
56KB

Download
memory/2720-1-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2720-2-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download
memory/2720-7-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2720-8-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/2720-4-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads