da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c

Resubmissions

17-04-2024 09:04

240417-k1zmzaca81 10

17-04-2024 09:02

17-04-2024 09:02

17-04-2024 09:02

17-04-2024 09:02

17-04-2024 09:02

16-04-2024 14:04

Analysis

max time kernel
298s
max time network
302s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c.dll
Size

30KB
MD5

b950169921d1437cef4a85778cd81636
SHA1

3d20b1c6f93029ab557819efd1f32afc25ac1e88
SHA256

da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c
SHA512

d0b87c1a119ba712c8b85fcb442286133320ec03df589276106987f2947ebbc603dfabaad7e2efbec4998067ef508f1c12bbc5a54502097665315a7b9ba9cf70
SSDEEP

768:Ugj98hSEzIOxO+OZWBaFWsBC7wU6LPLoEf73Wud9BdoJrZmZEMb+:Z0IOxO+OZWBGWsB+w93L39BdoD

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

rundll32.exe

flow	pid	process
2	2976	rundll32.exe
3	2976	rundll32.exe
5	2976	rundll32.exe
7	2976	rundll32.exe
8	2976	rundll32.exe
9	2976	rundll32.exe
10	2976	rundll32.exe
11	2976	rundll32.exe
12	2976	rundll32.exe
13	2976	rundll32.exe
14	2976	rundll32.exe
15	2976	rundll32.exe
16	2976	rundll32.exe
17	2976	rundll32.exe
18	2976	rundll32.exe
19	2976	rundll32.exe
20	2976	rundll32.exe
21	2976	rundll32.exe
22	2976	rundll32.exe
23	2976	rundll32.exe
24	2976	rundll32.exe
25	2976	rundll32.exe
26	2976	rundll32.exe
27	2976	rundll32.exe
28	2976	rundll32.exe
29	2976	rundll32.exe
30	2976	rundll32.exe
31	2976	rundll32.exe
32	2976	rundll32.exe
33	2976	rundll32.exe
34	2976	rundll32.exe
35	2976	rundll32.exe
36	2976	rundll32.exe
37	2976	rundll32.exe
38	2976	rundll32.exe
39	2976	rundll32.exe
40	2976	rundll32.exe
41	2976	rundll32.exe
42	2976	rundll32.exe
43	2976	rundll32.exe
44	2976	rundll32.exe
45	2976	rundll32.exe
46	2976	rundll32.exe
47	2976	rundll32.exe
48	2976	rundll32.exe
49	2976	rundll32.exe
50	2976	rundll32.exe
51	2976	rundll32.exe
52	2976	rundll32.exe
53	2976	rundll32.exe
54	2976	rundll32.exe
55	2976	rundll32.exe
56	2976	rundll32.exe
57	2976	rundll32.exe
58	2976	rundll32.exe
59	2976	rundll32.exe
60	2976	rundll32.exe
61	2976	rundll32.exe
62	2976	rundll32.exe
63	2976	rundll32.exe
64	2976	rundll32.exe
65	2976	rundll32.exe
66	2976	rundll32.exe
67	2976	rundll32.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
6 ip4.seeip.org
7 ip4.seeip.org
4 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

flow	ioc
5	api.ipify.org
6	ip4.seeip.org
7	ip4.seeip.org
4	api.ipify.org

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2928 wrote to memory of 2976	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2976	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2976	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2976	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2976	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2976	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2976	2928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Proxy

T1090

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads