Analysis
-
max time kernel
142s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 19:45
Static task
static1
Behavioral task
behavioral1
Sample
24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea.dll
Resource
win10v2004-20240426-en
General
-
Target
24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea.dll
-
Size
137KB
-
MD5
54242b49850eaa3361c1b62f569670c6
-
SHA1
628d307897f84a7e984af60416191f9fc70d8066
-
SHA256
24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea
-
SHA512
17353222b58a32e6b934f8afb38dcf745fd8ea7259bad5522e47d02770c30114d6b33c4d9b7210073004774092d41401733290fb85fcb77843aedb8f7e5426c9
-
SSDEEP
3072:5R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuE:U25GgFny61mraW
Malware Config
Signatures
-
Registers new Print Monitor 2 TTPs 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Spooler\ImagePath = "Spoolsv.exe" rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\com\comb.dll rundll32.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\AppPatch\ComBack.Dll rundll32.exe File created C:\Windows\AppPatch\ComBack.Dll rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2612 1752 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1284 wrote to memory of 1752 1284 rundll32.exe rundll32.exe PID 1284 wrote to memory of 1752 1284 rundll32.exe rundll32.exe PID 1284 wrote to memory of 1752 1284 rundll32.exe rundll32.exe PID 1284 wrote to memory of 1752 1284 rundll32.exe rundll32.exe PID 1284 wrote to memory of 1752 1284 rundll32.exe rundll32.exe PID 1284 wrote to memory of 1752 1284 rundll32.exe rundll32.exe PID 1284 wrote to memory of 1752 1284 rundll32.exe rundll32.exe PID 1752 wrote to memory of 2612 1752 rundll32.exe WerFault.exe PID 1752 wrote to memory of 2612 1752 rundll32.exe WerFault.exe PID 1752 wrote to memory of 2612 1752 rundll32.exe WerFault.exe PID 1752 wrote to memory of 2612 1752 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea.dll,#12⤵
- Registers new Print Monitor
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 2323⤵
- Program crash
PID:2612
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding1⤵PID:2632