Analysis

  • max time kernel
    1192s
  • max time network
    1201s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 02:40

General

  • Target

    chlorinates.dll

  • Size

    13.3MB

  • MD5

    7604a8bc5e2f8aa350a0e142388d44ab

  • SHA1

    1f462fbbc10d2ee5e9894a6fc0e9de0706ee525f

  • SHA256

    10acfc44e2ca27846698b4ce3bd09be1fd3a3cae5f4ca1c8d18b51d2493c8a99

  • SHA512

    466ef6b92390738051c71289adf2908725206a85d61b5be1aa867399384bc8f7ef66ac8f9f46518c9ca40e7a1e1c69583d1cb2f6e061c375855ba9c107ce6c8c

  • SSDEEP

    393216:ijxK+okzk1UbMnYnmqJ8NCIXWHfEizt5:ijxK+okg18MYY8IXWHfEG

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 24 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\chlorinates.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "get-wmiobject win32_computersystem | select-object -expandproperty domain"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2140
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& nslookup myip.opendns.com resolver1.opendns.com"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\system32\nslookup.exe
        "C:\Windows\system32\nslookup.exe" myip.opendns.com resolver1.opendns.com
        3⤵
          PID:1860

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

            Filesize

            7KB

            MD5

            2357258a3dbee32ad062e674aa4104e0

            SHA1

            4c877d30deddb8c3014bf1076bae8e42889e4106

            SHA256

            7b8b068c8583662dcc48d52be249d347d9e068368c4c27aac6716372c53ae03b

            SHA512

            a0d1ea566f47fc01633a56eeeef3296366df37b702d81459b9512eb12ddc685db8af67d825c8d1aad3c243bb08eb66042880d33d4fce10e009d2c4ff45ec604c

          • memory/1804-9-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/1804-2-0x000007FEF4560000-0x000007FEF4FE4000-memory.dmp

            Filesize

            10.5MB

          • memory/1804-4-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/1804-5-0x000007FEF4560000-0x000007FEF4FE4000-memory.dmp

            Filesize

            10.5MB

          • memory/1804-6-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/1804-7-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/1804-3-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/1804-25-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/1804-24-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/1804-0-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/1804-8-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/1804-23-0x000007FEF4560000-0x000007FEF52BA000-memory.dmp

            Filesize

            13.4MB

          • memory/2140-14-0x000000001B670000-0x000000001B952000-memory.dmp

            Filesize

            2.9MB

          • memory/2140-15-0x0000000002860000-0x0000000002868000-memory.dmp

            Filesize

            32KB

          • memory/2232-22-0x0000000002860000-0x0000000002868000-memory.dmp

            Filesize

            32KB

          • memory/2232-21-0x000000001B630000-0x000000001B912000-memory.dmp

            Filesize

            2.9MB