Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 15:10
Static task
static1
Behavioral task
behavioral1
Sample
dino.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dino.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
launcher.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
launcher.bat
Resource
win10v2004-20240226-en
General
-
Target
launcher.bat
-
Size
87B
-
MD5
864189b29e0ee9338690f34f60d9ed61
-
SHA1
2f130b692da72031ca0089894b84d716319c3b9a
-
SHA256
6887bbcea8d76ccb3cdf324d5a7b0feea4a7bbc17e4c05c9e7e07c735ba565a4
-
SHA512
957853c8a9a67d0555ddeb3981440d9709ff2762a4e4ae7cf48bc2a8a4cb9304154b696411ea4a521871b8322bdb433fd36988e230b91d1656f6c0c8488abafb
Malware Config
Signatures
-
Blocklisted process makes network request 12 IoCs
Processes:
rundll32.exeflow pid process 20 3576 rundll32.exe 21 3576 rundll32.exe 32 3576 rundll32.exe 36 3576 rundll32.exe 54 3576 rundll32.exe 55 3576 rundll32.exe 56 3576 rundll32.exe 57 3576 rundll32.exe 58 3576 rundll32.exe 59 3576 rundll32.exe 60 3576 rundll32.exe 64 3576 rundll32.exe -
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral4/memory/3576-2-0x00000000023B0000-0x0000000002786000-memory.dmp dave -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 4304 wrote to memory of 1640 4304 cmd.exe rundll32.exe PID 4304 wrote to memory of 1640 4304 cmd.exe rundll32.exe PID 1640 wrote to memory of 3576 1640 rundll32.exe rundll32.exe PID 1640 wrote to memory of 3576 1640 rundll32.exe rundll32.exe PID 1640 wrote to memory of 3576 1640 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe dino.dll ADMISSIONS_get0_admissionAuthority2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe dino.dll ADMISSIONS_get0_admissionAuthority3⤵
- Blocklisted process makes network request
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3576-0-0x0000000002790000-0x0000000002B68000-memory.dmpFilesize
3.8MB
-
memory/3576-2-0x00000000023B0000-0x0000000002786000-memory.dmpFilesize
3.8MB
-
memory/3576-5-0x0000000002B70000-0x0000000002F4F000-memory.dmpFilesize
3.9MB
-
memory/3576-13-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-14-0x00000000779E2000-0x00000000779E3000-memory.dmpFilesize
4KB
-
memory/3576-15-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-16-0x00000000779E2000-0x00000000779E3000-memory.dmpFilesize
4KB
-
memory/3576-17-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-18-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-19-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-20-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-21-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-22-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-23-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-24-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-25-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-27-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-28-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-36-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-41-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB
-
memory/3576-44-0x0000000003420000-0x0000000003C2A000-memory.dmpFilesize
8.0MB