da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c

Resubmissions

17-04-2024 09:04

240417-k1zmzaca81 10

17-04-2024 09:02

17-04-2024 09:02

17-04-2024 09:02

17-04-2024 09:02

17-04-2024 09:02

16-04-2024 14:04

Analysis

max time kernel
600s
max time network
598s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c.dll
Size

30KB
MD5

b950169921d1437cef4a85778cd81636
SHA1

3d20b1c6f93029ab557819efd1f32afc25ac1e88
SHA256

da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c
SHA512

d0b87c1a119ba712c8b85fcb442286133320ec03df589276106987f2947ebbc603dfabaad7e2efbec4998067ef508f1c12bbc5a54502097665315a7b9ba9cf70
SSDEEP

768:Ugj98hSEzIOxO+OZWBaFWsBC7wU6LPLoEf73Wud9BdoJrZmZEMb+:Z0IOxO+OZWBGWsB+w93L39BdoD

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

rundll32.exe

flow	pid	process
24	4452	rundll32.exe
25	4452	rundll32.exe
29	4452	rundll32.exe
30	4452	rundll32.exe
40	4452	rundll32.exe
46	4452	rundll32.exe
47	4452	rundll32.exe
50	4452	rundll32.exe
51	4452	rundll32.exe
53	4452	rundll32.exe
54	4452	rundll32.exe
55	4452	rundll32.exe
56	4452	rundll32.exe
59	4452	rundll32.exe
60	4452	rundll32.exe
63	4452	rundll32.exe
64	4452	rundll32.exe
66	4452	rundll32.exe
67	4452	rundll32.exe
73	4452	rundll32.exe
74	4452	rundll32.exe
76	4452	rundll32.exe
77	4452	rundll32.exe
79	4452	rundll32.exe
80	4452	rundll32.exe
82	4452	rundll32.exe
83	4452	rundll32.exe
85	4452	rundll32.exe
86	4452	rundll32.exe
88	4452	rundll32.exe
89	4452	rundll32.exe
91	4452	rundll32.exe
92	4452	rundll32.exe
94	4452	rundll32.exe
95	4452	rundll32.exe
101	4452	rundll32.exe
102	4452	rundll32.exe
103	4452	rundll32.exe
106	4452	rundll32.exe
107	4452	rundll32.exe
108	4452	rundll32.exe
109	4452	rundll32.exe
112	4452	rundll32.exe
113	4452	rundll32.exe
115	4452	rundll32.exe
116	4452	rundll32.exe
118	4452	rundll32.exe
119	4452	rundll32.exe
121	4452	rundll32.exe
122	4452	rundll32.exe
123	4452	rundll32.exe
124	4452	rundll32.exe
127	4452	rundll32.exe
128	4452	rundll32.exe
130	4452	rundll32.exe
131	4452	rundll32.exe
132	4452	rundll32.exe
133	4452	rundll32.exe
136	4452	rundll32.exe
137	4452	rundll32.exe
139	4452	rundll32.exe
140	4452	rundll32.exe
142	4452	rundll32.exe
143	4452	rundll32.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 api.ipify.org
29 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

flow	ioc
28	api.ipify.org
29	api.ipify.org

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4052 wrote to memory of 4452	4052	rundll32.exe	rundll32.exe
PID 4052 wrote to memory of 4452	4052	rundll32.exe	rundll32.exe
PID 4052 wrote to memory of 4452	4052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Proxy

T1090

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads