Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
11/06/2024, 22:43
General
- Target 62a9d8a631ddadc83484bf1b73df71a8158d6f357ad100f79499073763f5635b.dll
- Size 560KB
- Sample240611-2njjnavdnh
- SHA256 62a9d8a631ddadc83484bf1b73df71a8158d6f357ad100f79499073763f5635b
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\62a9d8a631ddadc83484bf1b73df71a8158d6f357ad100f79499073763f5635b.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\regedt32.exeC:\Windows\system32\regedt32.exe1⤵
-
C:\Windows\system32\MultiDigiMon.exeC:\Windows\system32\MultiDigiMon.exe1⤵
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\lXMWqi.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{12c93495-b129-a0da-69c0-fffbf7f4a35d}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{12c93495-b129-a0da-69c0-fffbf7f4a35d}"2⤵
-
-
C:\Windows\system32\MDEServer.exeC:\Windows\system32\MDEServer.exe1⤵
-
C:\Windows\system32\fixmapi.exeC:\Windows\system32\fixmapi.exe1⤵
-
C:\Windows\system32\wimserv.exeC:\Windows\system32\wimserv.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\RFA8.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\5uO0cTZ.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Uoyotc" /SC minute /MO 60 /TR "C:\Windows\system32\9877\wimserv.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
5uO0cTZ.cmd
6rM40E2.tmp
Du4045.tmp
RFA8.cmd
lXMWqi.cmd
Gwzfotnrlhcmn.lnk
ie4uinit.exe
memory/2960-2-0x0000025E3AE40000-0x0000025E3AE47000-memory.dmp
memory/2960-5-0x0000000140000000-0x000000014008C000-memory.dmp
memory/2960-0-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-26-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-21-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-46-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-36-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-27-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-19-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-41-0x0000000001340000-0x0000000001347000-memory.dmp
memory/3100-29-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-68-0x00007FFD17AE0000-0x00007FFD17AF0000-memory.dmp
memory/3100-28-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-6-0x00007FFD15DBA000-0x00007FFD15DBB000-memory.dmp
memory/3100-25-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-24-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-23-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-22-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-56-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-20-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-18-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-17-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-16-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-15-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-14-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-13-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-12-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-11-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-10-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-9-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-8-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-7-0x0000000140000000-0x000000014008C000-memory.dmp
memory/3100-3-0x0000000002F50000-0x0000000002F51000-memory.dmp