Resubmissions
01/05/2024, 18:06
240501-wp7pzscg9x1018/04/2024, 14:15
240418-rkp7xsfd391017/04/2024, 14:48
240417-r6e9vacg648Analysis
- max time kernel
450s - max time network
495s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
01/05/2024, 18:06
General
- Target forcedelctl.dll
- Size 956KB
- Sample240501-wp7pzscg9x
- SHA256 3bca1dcaef4430272b9029c9a4bc8be0d45ecff66e8de8679ed30d8afab00f6f
Score
10/10
Malware Config
Signatures
- SSLoad
SSLoad Unpacked DLL payload.
- Detects SSLoad Unpacked payload 2 IoCs
- Blocklisted process makes network request 2 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\forcedelctl.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\forcedelctl.dll,#12⤵
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4944-0-0x0000000010000000-0x00000000100F9000-memory.dmp
memory/4944-2-0x0000000002D70000-0x0000000002DE3000-memory.dmp
memory/4944-4-0x0000000002C90000-0x0000000002D05000-memory.dmp
memory/4944-5-0x0000000010000000-0x00000000100F9000-memory.dmp
memory/4944-6-0x0000000010000000-0x00000000100F9000-memory.dmp