Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-04-2024 08:04
Static task
static1
Behavioral task
behavioral1
Sample
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
Resource
win10v2004-20240226-en
General
-
Target
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
-
Size
390KB
-
MD5
8c64181ff0dc12c87e443aae94bf6650
-
SHA1
e91d7ebd17912785caa3e71ef1571dc01b1cd854
-
SHA256
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5
-
SHA512
4854565b054297dffc13b659a53059ee8731dca02f3027501254551cb4af20b68fb121d03e528151cf910238b49bf00a3827e74e4bb68faf85ebc50d02ad5c17
-
SSDEEP
12288:ef/X4NTn/xVkNG+w+9OqFoK323qdQYKU3:EXATn/xVkNg+95vdQa
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\A1DB.tmp mimikatz -
Executes dropped EXE 1 IoCs
Processes:
A1DB.tmppid process 2580 A1DB.tmp -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exepid process 2896 rundll32.exe 2896 rundll32.exe 2368 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe rundll32.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\MDIParent.zip rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.PPT rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe rundll32.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE rundll32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\ACTIVITY.CFG rundll32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEM.CFG rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACT.CFG rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe rundll32.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip rundll32.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe rundll32.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip rundll32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REMOTE.CFG rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKACC.CFG rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe rundll32.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\SERVWRAP.ASP rundll32.exe -
Drops file in Windows directory 4 IoCs
Processes:
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exerundll32.exedescription ioc process File created C:\Windows\dllcm.dat 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe File opened for modification C:\Windows\dllcm.dat rundll32.exe File created C:\Windows\dllcm rundll32.exe File created C:\Windows\dllhost.dat rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
rundll32.exeA1DB.tmppid process 2896 rundll32.exe 2580 A1DB.tmp 2580 A1DB.tmp 2580 A1DB.tmp 2580 A1DB.tmp 2580 A1DB.tmp -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rundll32.exeA1DB.tmpdescription pid process Token: SeShutdownPrivilege 2896 rundll32.exe Token: SeDebugPrivilege 2896 rundll32.exe Token: SeTcbPrivilege 2896 rundll32.exe Token: SeDebugPrivilege 2580 A1DB.tmp -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exerundll32.execmd.exedescription pid process target process PID 2648 wrote to memory of 2896 2648 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 2648 wrote to memory of 2896 2648 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 2648 wrote to memory of 2896 2648 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 2648 wrote to memory of 2896 2648 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 2648 wrote to memory of 2896 2648 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 2648 wrote to memory of 2896 2648 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 2648 wrote to memory of 2896 2648 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 2896 wrote to memory of 2912 2896 rundll32.exe cmd.exe PID 2896 wrote to memory of 2912 2896 rundll32.exe cmd.exe PID 2896 wrote to memory of 2912 2896 rundll32.exe cmd.exe PID 2896 wrote to memory of 2912 2896 rundll32.exe cmd.exe PID 2896 wrote to memory of 2580 2896 rundll32.exe A1DB.tmp PID 2896 wrote to memory of 2580 2896 rundll32.exe A1DB.tmp PID 2896 wrote to memory of 2580 2896 rundll32.exe A1DB.tmp PID 2896 wrote to memory of 2580 2896 rundll32.exe A1DB.tmp PID 2912 wrote to memory of 2700 2912 cmd.exe schtasks.exe PID 2912 wrote to memory of 2700 2912 cmd.exe schtasks.exe PID 2912 wrote to memory of 2700 2912 cmd.exe schtasks.exe PID 2912 wrote to memory of 2700 2912 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe"C:\Users\Admin\AppData\Local\Temp\4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\dllcm.dat #12⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 09:083⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 09:084⤵
- Creates scheduled task(s)
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp" \\.\pipe\{2C83C79A-FAA6-4A46-8537-D85818C8501B}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
353KB
MD57c0747971df2d07ceca15f0edc0a9f6e
SHA14db833ba4ddf88c36d6956928721547e1e221c0d
SHA2564dd22017d6f77573cc0f4999d22b45f1d71e6435350d4a5654ee1e93fec30827
SHA512d5da33a23fa39441901b9f4cc08468692d076545ffd29c082982fde7e93bb27464445478a37629a47d56594fd019863a1de52573c47ccf8d2252eb2047f8606e
-
Filesize
55KB
MD57e37ab34ecdcc3e77e24522ddfd4852d
SHA138e2855e11e353cedf9a8a4f2f2747f1c5c07fcf
SHA25602ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f
SHA5121b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587