Analysis
-
max time kernel
161s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 05:15
Static task
static1
Behavioral task
behavioral1
Sample
ca335fb2ca46c19a6c56c843ef622782b5e65169ae512918dc425acad023cd38.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ca335fb2ca46c19a6c56c843ef622782b5e65169ae512918dc425acad023cd38.dll
Resource
win10v2004-20240412-en
General
-
Target
ca335fb2ca46c19a6c56c843ef622782b5e65169ae512918dc425acad023cd38.dll
-
Size
240KB
-
MD5
dbae6edd483722415063188a27f4c1fd
-
SHA1
6018b3c7b290925c9e2d146ab39bfddca02ee7b5
-
SHA256
ca335fb2ca46c19a6c56c843ef622782b5e65169ae512918dc425acad023cd38
-
SHA512
8c9034cc4c244377a98e75fca5af018e33d9a092c96af9b94108f472f7433331a8898e96fb79169edfec9a1338e6592c404f74affe5b25099d3a5c724bd23aba
-
SSDEEP
6144:65r3lV6n42+3WSKhxD8RVo2rcaGKNqAwyotp2G:6C+3xWDY9IpKNTwyo/
Malware Config
Signatures
-
Blocklisted process makes network request 8 IoCs
Processes:
rundll32.exeflow pid process 25 4900 rundll32.exe 42 4900 rundll32.exe 43 4900 rundll32.exe 44 4900 rundll32.exe 45 4900 rundll32.exe 46 4900 rundll32.exe 57 4900 rundll32.exe 61 4900 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Platform = "C:\\Windows\\SysWOW64\\rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ca335fb2ca46c19a6c56c843ef622782b5e65169ae512918dc425acad023cd38.dll\",Erase" rundll32.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\b: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 4900 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3196 wrote to memory of 4900 3196 rundll32.exe rundll32.exe PID 3196 wrote to memory of 4900 3196 rundll32.exe rundll32.exe PID 3196 wrote to memory of 4900 3196 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca335fb2ca46c19a6c56c843ef622782b5e65169ae512918dc425acad023cd38.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca335fb2ca46c19a6c56c843ef622782b5e65169ae512918dc425acad023cd38.dll,#12⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1