152429f85b982b9354f6bcf6de5add07b7825d356c0254e6032d2d341b929817

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1bdb4b370bb9b4fbf5323b89468b86b.dll
Size

197KB
MD5

e1bdb4b370bb9b4fbf5323b89468b86b
SHA1

fb50e585c25aead56d0f72c62c4ed8a754581f94
SHA256

152429f85b982b9354f6bcf6de5add07b7825d356c0254e6032d2d341b929817
SHA512

529d490e91c3aed7ff9dde4aaebd43cf290628ded0250e7a80cff6d07fcfd11820d75c1db60b3a58a572b6b8f40d7601872299a87178994b493a911f73b3e758
SSDEEP

6144:DFcH73kQs8gsKFvrdS4etHgOzqqDGDa+:DaH7UQsFs6vrc4etHAqSD

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2040	rundll32.exe
Token: SeSecurityPrivilege	2040	rundll32.exe
Token: SeTakeOwnershipPrivilege	2040	rundll32.exe
Token: SeLoadDriverPrivilege	2040	rundll32.exe
Token: SeSystemProfilePrivilege	2040	rundll32.exe
Token: SeSystemtimePrivilege	2040	rundll32.exe
Token: SeProfSingleProcessPrivilege	2040	rundll32.exe
Token: SeIncBasePriorityPrivilege	2040	rundll32.exe
Token: SeCreatePagefilePrivilege	2040	rundll32.exe
Token: SeShutdownPrivilege	2040	rundll32.exe
Token: SeDebugPrivilege	2040	rundll32.exe
Token: SeSystemEnvironmentPrivilege	2040	rundll32.exe
Token: SeRemoteShutdownPrivilege	2040	rundll32.exe
Token: SeUndockPrivilege	2040	rundll32.exe
Token: SeManageVolumePrivilege	2040	rundll32.exe
Token: 33	2040	rundll32.exe
Token: 34	2040	rundll32.exe
Token: 35	2040	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2200 wrote to memory of 2040	2200	rundll32.exe	28
PID 2040 wrote to memory of 336	2040	rundll32.exe	2
PID 2040 wrote to memory of 336	2040	rundll32.exe	2
PID 2040 wrote to memory of 336	2040	rundll32.exe	2
PID 2040 wrote to memory of 364	2040	rundll32.exe	3
PID 2040 wrote to memory of 364	2040	rundll32.exe	3
PID 2040 wrote to memory of 364	2040	rundll32.exe	3
PID 2040 wrote to memory of 392	2040	rundll32.exe	4
PID 2040 wrote to memory of 392	2040	rundll32.exe	4
PID 2040 wrote to memory of 432	2040	rundll32.exe	5
PID 2040 wrote to memory of 432	2040	rundll32.exe	5
PID 2040 wrote to memory of 476	2040	rundll32.exe	6
PID 2040 wrote to memory of 476	2040	rundll32.exe	6
PID 2040 wrote to memory of 476	2040	rundll32.exe	6
PID 2040 wrote to memory of 484	2040	rundll32.exe	7
PID 2040 wrote to memory of 484	2040	rundll32.exe	7
PID 2040 wrote to memory of 484	2040	rundll32.exe	7
PID 2040 wrote to memory of 492	2040	rundll32.exe	8
PID 2040 wrote to memory of 492	2040	rundll32.exe	8
PID 2040 wrote to memory of 492	2040	rundll32.exe	8
PID 2040 wrote to memory of 584	2040	rundll32.exe	9
PID 2040 wrote to memory of 584	2040	rundll32.exe	9
PID 2040 wrote to memory of 584	2040	rundll32.exe	9
PID 2040 wrote to memory of 660	2040	rundll32.exe	10
PID 2040 wrote to memory of 660	2040	rundll32.exe	10
PID 2040 wrote to memory of 660	2040	rundll32.exe	10
PID 2040 wrote to memory of 748	2040	rundll32.exe	11
PID 2040 wrote to memory of 748	2040	rundll32.exe	11
PID 2040 wrote to memory of 748	2040	rundll32.exe	11
PID 2040 wrote to memory of 796	2040	rundll32.exe	12
PID 2040 wrote to memory of 796	2040	rundll32.exe	12
PID 2040 wrote to memory of 796	2040	rundll32.exe	12
PID 2040 wrote to memory of 840	2040	rundll32.exe	13
PID 2040 wrote to memory of 840	2040	rundll32.exe	13
PID 2040 wrote to memory of 840	2040	rundll32.exe	13
PID 2040 wrote to memory of 956	2040	rundll32.exe	15
PID 2040 wrote to memory of 956	2040	rundll32.exe	15
PID 2040 wrote to memory of 956	2040	rundll32.exe	15
PID 2040 wrote to memory of 1020	2040	rundll32.exe	16
PID 2040 wrote to memory of 1020	2040	rundll32.exe	16
PID 2040 wrote to memory of 1020	2040	rundll32.exe	16
PID 2040 wrote to memory of 328	2040	rundll32.exe	17
PID 2040 wrote to memory of 328	2040	rundll32.exe	17
PID 2040 wrote to memory of 328	2040	rundll32.exe	17
PID 2040 wrote to memory of 1032	2040	rundll32.exe	18
PID 2040 wrote to memory of 1032	2040	rundll32.exe	18
PID 2040 wrote to memory of 1032	2040	rundll32.exe	18
PID 2040 wrote to memory of 1120	2040	rundll32.exe	19
PID 2040 wrote to memory of 1120	2040	rundll32.exe	19
PID 2040 wrote to memory of 1188	2040	rundll32.exe	20
PID 2040 wrote to memory of 1188	2040	rundll32.exe	20
PID 2040 wrote to memory of 1252	2040	rundll32.exe	21
PID 2040 wrote to memory of 1252	2040	rundll32.exe	21
PID 2040 wrote to memory of 272	2040	rundll32.exe	23
PID 2040 wrote to memory of 272	2040	rundll32.exe	23
PID 2040 wrote to memory of 1996	2040	rundll32.exe	24
PID 2040 wrote to memory of 1996	2040	rundll32.exe	24
PID 2040 wrote to memory of 1996	2040	rundll32.exe	24

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:364
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:584
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:272
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:660
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:748
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:796
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1188
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:840
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:956
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:1020
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:328
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1032
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1120
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1996
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2316
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:484
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:492

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1bdb4b370bb9b4fbf5323b89468b86b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1bdb4b370bb9b4fbf5323b89468b86b.dll,#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-1-0x00000000716F0000-0x00000000716F1000-memory.dmp

Filesize
4KB

Download
memory/2040-0-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/2040-2-0x0000000074D80000-0x0000000074E90000-memory.dmp

Filesize
1.1MB

Download
memory/2040-3-0x000000005F070000-0x000000005F071000-memory.dmp

Filesize
4KB

Download
memory/2040-5-0x000000005F0D0000-0x000000005F0D1000-memory.dmp

Filesize
4KB

Download
memory/2040-7-0x000000005F080000-0x000000005F081000-memory.dmp

Filesize
4KB

Download
memory/2040-72-0x00000000716F0000-0x00000000716F1000-memory.dmp

Filesize
4KB

Download
memory/2040-74-0x0000000074D80000-0x0000000074E90000-memory.dmp

Filesize
1.1MB

Download
memory/2040-73-0x0000000074D80000-0x0000000074E90000-memory.dmp

Filesize
1.1MB

Download