Analysis

  • max time kernel
    1190s
  • max time network
    1202s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/06/2024, 02:40

General

  • Target

    chlorinates.dll

  • Size

    13.3MB

  • MD5

    7604a8bc5e2f8aa350a0e142388d44ab

  • SHA1

    1f462fbbc10d2ee5e9894a6fc0e9de0706ee525f

  • SHA256

    10acfc44e2ca27846698b4ce3bd09be1fd3a3cae5f4ca1c8d18b51d2493c8a99

  • SHA512

    466ef6b92390738051c71289adf2908725206a85d61b5be1aa867399384bc8f7ef66ac8f9f46518c9ca40e7a1e1c69583d1cb2f6e061c375855ba9c107ce6c8c

  • SSDEEP

    393216:ijxK+okzk1UbMnYnmqJ8NCIXWHfEizt5:ijxK+okg18MYY8IXWHfEG

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 38 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\chlorinates.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:336
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "get-wmiobject win32_computersystem | select-object -expandproperty domain"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& nslookup myip.opendns.com resolver1.opendns.com"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Windows\system32\nslookup.exe
        "C:\Windows\system32\nslookup.exe" myip.opendns.com resolver1.opendns.com
        3⤵
          PID:2212

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            3KB

            MD5

            22e796539d05c5390c21787da1fb4c2b

            SHA1

            55320ebdedd3069b2aaf1a258462600d9ef53a58

            SHA256

            7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92

            SHA512

            d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            161f955c57fd28c6ec65ac6e654db3e1

            SHA1

            a6730d9ea505e13871a3b173852041c83376d400

            SHA256

            e5915b7488ae418e4d81fda1a0b72a04529bf9cdb26b88aacfdfb7466a409f9d

            SHA512

            10d4787848d6a383500ebc9b5f4a9fe8f45aafab503479a887e4aab6329ce0509f888ef46f0cbef591ac4b005386c4e05ca37883bcaad046af3f7c59b04fce1a

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_elcg0ndq.r51.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/336-37-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-50-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-5-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-7-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-8-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-9-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-6-0x00007FFCEFF20000-0x00007FFCF09A4000-memory.dmp

            Filesize

            10.5MB

          • memory/336-4-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-51-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-39-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-45-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-44-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-43-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-3-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-2-0x00007FFCEFF20000-0x00007FFCF09A4000-memory.dmp

            Filesize

            10.5MB

          • memory/336-0-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/336-38-0x00007FFCEFF20000-0x00007FFCF0C7A000-memory.dmp

            Filesize

            13.4MB

          • memory/4084-10-0x00007FFCEF453000-0x00007FFCEF455000-memory.dmp

            Filesize

            8KB

          • memory/4084-25-0x00007FFCEF450000-0x00007FFCEFF12000-memory.dmp

            Filesize

            10.8MB

          • memory/4084-22-0x00007FFCEF450000-0x00007FFCEFF12000-memory.dmp

            Filesize

            10.8MB

          • memory/4084-21-0x00007FFCEF450000-0x00007FFCEFF12000-memory.dmp

            Filesize

            10.8MB

          • memory/4084-20-0x00007FFCEF450000-0x00007FFCEFF12000-memory.dmp

            Filesize

            10.8MB

          • memory/4084-19-0x000002244FCC0000-0x000002244FCE2000-memory.dmp

            Filesize

            136KB