Analysis

  • max time kernel
    1190s
  • max time network
    1201s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 02:40

General

  • Target

    chlorinates.dll

  • Size

    13.3MB

  • MD5

    7604a8bc5e2f8aa350a0e142388d44ab

  • SHA1

    1f462fbbc10d2ee5e9894a6fc0e9de0706ee525f

  • SHA256

    10acfc44e2ca27846698b4ce3bd09be1fd3a3cae5f4ca1c8d18b51d2493c8a99

  • SHA512

    466ef6b92390738051c71289adf2908725206a85d61b5be1aa867399384bc8f7ef66ac8f9f46518c9ca40e7a1e1c69583d1cb2f6e061c375855ba9c107ce6c8c

  • SSDEEP

    393216:ijxK+okzk1UbMnYnmqJ8NCIXWHfEizt5:ijxK+okg18MYY8IXWHfEG

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 22 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\chlorinates.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "get-wmiobject win32_computersystem | select-object -expandproperty domain"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:528
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& nslookup myip.opendns.com resolver1.opendns.com"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\system32\nslookup.exe
        "C:\Windows\system32\nslookup.exe" myip.opendns.com resolver1.opendns.com
        3⤵
          PID:2432

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            3KB

            MD5

            223bd4ae02766ddc32e6145fd1a29301

            SHA1

            900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

            SHA256

            1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

            SHA512

            648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            071e40c48b137a5d464968fcac2ed5f9

            SHA1

            26d7916861ada434d4457569055aeffebb2e1617

            SHA256

            96127b0d042da66bf8332ddd5a22ba4046c47fa2306d18319c22097560d28f5e

            SHA512

            8d6d81091f04e06c3c4562f606d3b3ab2d3ecf015d8f6c0ac75b1477450aaa3d98b7ddf79b682ff69c3fef1c109443a8cb23d257442cff6d0bcb575cb6c0e67e

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zv21id44.cvs.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/528-9-0x000001768AF60000-0x000001768AF82000-memory.dmp

            Filesize

            136KB

          • memory/528-23-0x00007FFF356C0000-0x00007FFF36181000-memory.dmp

            Filesize

            10.8MB

          • memory/528-20-0x00007FFF356C0000-0x00007FFF36181000-memory.dmp

            Filesize

            10.8MB

          • memory/528-19-0x00007FFF356C0000-0x00007FFF36181000-memory.dmp

            Filesize

            10.8MB

          • memory/528-8-0x00007FFF356C3000-0x00007FFF356C5000-memory.dmp

            Filesize

            8KB

          • memory/4304-6-0x00007FFF36F90000-0x00007FFF37A14000-memory.dmp

            Filesize

            10.5MB

          • memory/4304-7-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-0-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-5-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-4-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-3-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-2-0x00007FFF36F90000-0x00007FFF37A14000-memory.dmp

            Filesize

            10.5MB

          • memory/4304-36-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-37-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-38-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-43-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-44-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB

          • memory/4304-45-0x00007FFF36F90000-0x00007FFF37CEA000-memory.dmp

            Filesize

            13.4MB