Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe
- Size 407KB
- Sample240612-esrpha1ank
- SHA256 62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee
- MD5 568217dc15ace520c91b7530303546a5
- SHA1 4053f4714a9d03f90e83602490ed29d82e94f1a6
- SHA512 48a09631fdf7d8ebb17c7b1415908f72000a165c44841160a7358462821e04aa23133147db2718e2bd500388278ba925b73e3d52770e7ac40983077d7f56701d
- SSDEEP 6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4F:gtRfJcNYFNm8UhlZGseF
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 8 IoCs
flow pid Process 3 4812 rundll32.exe 10 4812 rundll32.exe 11 4812 rundll32.exe 12 4812 rundll32.exe 18 4812 rundll32.exe 19 4812 rundll32.exe 20 4812 rundll32.exe 23 4812 rundll32.exe - Deletes itself 1 IoCs
pid Process 4944 iaglrzc.exe - Executes dropped EXE 1 IoCs
pid Process 4944 iaglrzc.exe - Loads dropped DLL 1 IoCs
pid Process 4812 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\rhyjtvnlu\\tjvegvd.dll\",Verify" rundll32.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\z: rundll32.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4812 rundll32.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\rhyjtvnlu iaglrzc.exe File created \??\c:\Program Files\rhyjtvnlu\tjvegvd.dll iaglrzc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1700 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe 4812 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4812 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 364 62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe 4944 iaglrzc.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 364 wrote to memory of 2316 364 62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe 90 PID 364 wrote to memory of 2316 364 62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe 90 PID 364 wrote to memory of 2316 364 62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe 90 PID 2316 wrote to memory of 1700 2316 cmd.exe 93 PID 2316 wrote to memory of 1700 2316 cmd.exe 93 PID 2316 wrote to memory of 1700 2316 cmd.exe 93 PID 2316 wrote to memory of 4944 2316 cmd.exe 95 PID 2316 wrote to memory of 4944 2316 cmd.exe 95 PID 2316 wrote to memory of 4944 2316 cmd.exe 95 PID 4944 wrote to memory of 4812 4944 iaglrzc.exe 97 PID 4944 wrote to memory of 4812 4944 iaglrzc.exe 97 PID 4944 wrote to memory of 4812 4944 iaglrzc.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe"C:\Users\Admin\AppData\Local\Temp\62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\iaglrzc.exe "C:\Users\Admin\AppData\Local\Temp\62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\iaglrzc.exeC:\Users\Admin\AppData\Local\Temp\\iaglrzc.exe "C:\Users\Admin\AppData\Local\Temp\62d2577a483c9d4ad9d88ab95535679c5588eb99c5060419baac4ab439ed9aee.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\rhyjtvnlu\tjvegvd.dll",Verify C:\Users\Admin\AppData\Local\Temp\iaglrzc.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:81⤵PID:2280
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\iaglrzc.exe
- Size 407KB
- SHA256 b09502e021827ab5b54df28b5ad88633e606ef2a6fee9fa13d71a28db8275710
- MD5 d9789422ccc53ed17775a3e437709534
- SHA1 5d762364101e93e05639707e4fa91172c8ff4362
- SHA512 5887d05aa6716a26c2a610cbf03bbb0d3aa52cc0a08d77a185ea987d7fdb9cf42c68100da1d7cb693894beb3d44847b4b7f6683f280f20e5afe2a3d515204cd6
- SSDEEP 6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH43:gtRfJcNYFNm8UhlZGse3
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Program Files\rhyjtvnlu\tjvegvd.dll
- Size 228KB
- SHA256 ab17a10322ea16101cae55c726c5dcc8edb023e61b12730c6e3e27a28f904616
- MD5 341e6b634b8392e55addcdfdf505ba8d
- SHA1 6333b312cc22af13ede33d7742c14455e086ecb4
- SHA512 460f80187ae5ff1f82e7ced449f0fef7bd9acad06df60f7828b09d3c1e2b85feb5f7b32971f57bfae069e6ac848fb4c4dab840bf6b4cb82f01bd67e29ee85c3a
- SSDEEP 6144:U1oEITTl5VCuHFrEy0wEOR7ndfAnVxERZ4CR3XaNI:5vVrHFrL05gdonVANpR
- MD5 SHA1 SHA512 SSDEEP