da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c

Resubmissions

17-04-2024 09:04

240417-k1zmzaca81 10

17-04-2024 09:02

17-04-2024 09:02

17-04-2024 09:02

17-04-2024 09:02

17-04-2024 09:02

16-04-2024 14:04

Analysis

max time kernel
1196s
max time network
1202s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c.dll
Size

30KB
MD5

b950169921d1437cef4a85778cd81636
SHA1

3d20b1c6f93029ab557819efd1f32afc25ac1e88
SHA256

da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c
SHA512

d0b87c1a119ba712c8b85fcb442286133320ec03df589276106987f2947ebbc603dfabaad7e2efbec4998067ef508f1c12bbc5a54502097665315a7b9ba9cf70
SSDEEP

768:Ugj98hSEzIOxO+OZWBaFWsBC7wU6LPLoEf73Wud9BdoJrZmZEMb+:Z0IOxO+OZWBGWsB+w93L39BdoD

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

rundll32.exe

flow	pid	process
2	2040	rundll32.exe
3	2040	rundll32.exe
5	2040	rundll32.exe
7	2040	rundll32.exe
8	2040	rundll32.exe
9	2040	rundll32.exe
10	2040	rundll32.exe
11	2040	rundll32.exe
12	2040	rundll32.exe
13	2040	rundll32.exe
14	2040	rundll32.exe
15	2040	rundll32.exe
16	2040	rundll32.exe
17	2040	rundll32.exe
18	2040	rundll32.exe
19	2040	rundll32.exe
20	2040	rundll32.exe
21	2040	rundll32.exe
22	2040	rundll32.exe
23	2040	rundll32.exe
24	2040	rundll32.exe
25	2040	rundll32.exe
26	2040	rundll32.exe
27	2040	rundll32.exe
28	2040	rundll32.exe
29	2040	rundll32.exe
30	2040	rundll32.exe
31	2040	rundll32.exe
32	2040	rundll32.exe
33	2040	rundll32.exe
34	2040	rundll32.exe
35	2040	rundll32.exe
36	2040	rundll32.exe
37	2040	rundll32.exe
38	2040	rundll32.exe
39	2040	rundll32.exe
40	2040	rundll32.exe
41	2040	rundll32.exe
42	2040	rundll32.exe
43	2040	rundll32.exe
44	2040	rundll32.exe
45	2040	rundll32.exe
46	2040	rundll32.exe
47	2040	rundll32.exe
48	2040	rundll32.exe
49	2040	rundll32.exe
50	2040	rundll32.exe
51	2040	rundll32.exe
52	2040	rundll32.exe
53	2040	rundll32.exe
54	2040	rundll32.exe
55	2040	rundll32.exe
56	2040	rundll32.exe
57	2040	rundll32.exe
58	2040	rundll32.exe
59	2040	rundll32.exe
60	2040	rundll32.exe
61	2040	rundll32.exe
62	2040	rundll32.exe
63	2040	rundll32.exe
64	2040	rundll32.exe
65	2040	rundll32.exe
66	2040	rundll32.exe
67	2040	rundll32.exe

Contacts a large (586) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 87.236.195.203
Destination IP 88.216.223.2
Destination IP 88.216.223.5
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
6 ip4.seeip.org
7 ip4.seeip.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

description	ioc
Destination IP	87.236.195.203
Destination IP	88.216.223.2
Destination IP	88.216.223.5

flow	ioc
4	api.ipify.org
5	api.ipify.org
6	ip4.seeip.org
7	ip4.seeip.org

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2200 wrote to memory of 2040	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2040	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2040	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2040	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2040	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2040	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2040	2200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Proxy

T1090

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads