Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
01/06/2024, 04:57
General
-
Target
efb2a3a0a0a03f5078818c9108f43cb658f92aac0b7b9710f5eccd9e36bc028b.dll
-
Size
496KB
-
MD5
af534395bb77e1033cefdc47afa86829
-
SHA1
9eab83d53442b540554e637ea46fa9c9928c6877
-
SHA256
efb2a3a0a0a03f5078818c9108f43cb658f92aac0b7b9710f5eccd9e36bc028b
-
SHA512
1c819463b18db284ea5269c2739a09e0c66ffd38dd501b19d568ce332f6bc51434231dc895c5670639aa68ccc5a46df0b09beddc6193e34ffd70056532c2a999
-
SSDEEP
6144:Pi05kH9OyU2uv5SRf/FWgFgtBgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:KrHGPv5Smpt6DmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\efb2a3a0a0a03f5078818c9108f43cb658f92aac0b7b9710f5eccd9e36bc028b.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe1⤵
-
C:\Windows\system32\audiodg.exeC:\Windows\system32\audiodg.exe1⤵
-
C:\Windows\system32\NetCfgNotifyObjectHost.exeC:\Windows\system32\NetCfgNotifyObjectHost.exe1⤵
-
C:\Windows\system32\CloudExperienceHostBroker.exeC:\Windows\system32\CloudExperienceHostBroker.exe1⤵
-
C:\Windows\system32\VSSVC.exeC:\Windows\system32\VSSVC.exe1⤵
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\qSxmkP9.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{b20545c2-dfb8-18ae-c9b7-e3de899dbcb9}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{b20545c2-dfb8-18ae-c9b7-e3de899dbcb9}"2⤵
-
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\v57f.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\sbCt.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Kspyygbb" /SC minute /MO 60 /TR "C:\Windows\system32\2607\raserver.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500KB
MD5de109323deef25c42d75615061240bed
SHA1df9e048e14b00ab5f7b78e019808dab8647c9665
SHA25656f8c9f147a2546477dc9efa81db8494014ac489048d1ea8092870eb8d989a0a
SHA5122435b47fa20c77ee6f9c33794ddd0a53a2fd2c251944dcd55785452ff0e64ec3cee654f16f2fd03e2f84d551cfe6dc6d2c52ec3291a2848f6bf0ec9b2361f578
-
Filesize
245B
MD561e374b140dcf85c8531da2021720abd
SHA153464bd624f005c4c6c742b9c56c463276b036dc
SHA256891750bd187ee64a04152e6ecef54d5cd877ad5952861861c0c44912b5736e17
SHA512fcab7a544a39012289386b472fbbbc336a0ba6cba39dcf10dd3c03ef06be74566cdf2142e9c7253f3307e145345a239ead8a4dd5b3aca74caee18fa3b0d7675d
-
Filesize
127B
MD50fc7f0f279e41c77d88f0e96e2209d4e
SHA1669ef6ca0a70690e9e67fca6a54f2faf36b3a923
SHA2568eea098daa7508f942a887da8a35cf3e72eb99e14761451b639eb6028dfa57b0
SHA51217e83f736f8e43f40a5a28a1acc12067b950ee14824b9f8bb609a32420063e2474ebb7ea3e7924aa97cb6298e0e048c5ef91c2c5fea82ae9ebdeab47c74f320d
-
Filesize
196B
MD57d082fbb049187cde8cb5e999162a1d7
SHA1fe59958a083386bfe9e9142ee1f475e141fd069d
SHA256d538b7ca3eddf856feb90bc01bfaf394c1d475b77d63f7f48cdcb5cc6b85e3a7
SHA512c87e3e954708cc0bfd0b52af515f7b84f57f1d0154861615b05c4eff72a50d297b716ae8a41153294e2075be46331d59a7609e5fde420ebcab8eef2b03bb8ff5
-
Filesize
500KB
MD509259f3ecf48c358a2fa79bfcd167477
SHA1f743833b6ef9c7c2af29464d21df443c1859b85c
SHA256917edc04438b6af3c921586ce187aa467fe4afd800fd3ff588a0aad116d61320
SHA512480454658f0f47bc8f38be7a4ce945e212103a92753fdb06df25ca5a702e8dfba91cdbfe80f5a894c07f089951bf797a22892d76c08d3e427a8c262d2e97ac05
-
Filesize
44KB
MD5591a98c65f624c52882c2b238d6cd4c4
SHA1c960d08c19d777069cf265dcc281807fbd8502d7
SHA2565e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA5121999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074
-
Filesize
994B
MD53a1563ad8df90b2afd32d6b35863938c
SHA1f3edaeca88db5112b41b0825c5760d927faf630f
SHA256e03b32fafc1838b09f528ac427189532178c075360cf66fe9bd25983d8a75661
SHA51284af811741ffb27889adee9cd485e0c0b30e5107b772a6a8a0379ebed4cd236314c801ba476554d71e5689715c0952d1955cba67cde47ca3ded3e8a46c950a86
-
Filesize
496KB
-
Filesize
28KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
28KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
64KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
4KB
-
Filesize
4KB