Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 02:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe
- Size 407KB
- Sample240613-c3xmdsvepp
- SHA256 158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b
- MD5 d9e9a89fb545fcdd48d9539fa0d70c14
- SHA1 2a7894805ad4acce61c7f1dffd58ab547c5f88ae
- SHA512 1c67746dde3bc7b6c137fe309d99ef1cf7ef56f2ded78a930c46e59e4a9ec0f28eda418ad3ef4e5f05f8b00669b522844052e2aea78061b6fcd4c96398d99df2
- SSDEEP 6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 8 IoCs
flow pid Process 11 2764 rundll32.exe 18 2764 rundll32.exe 21 2764 rundll32.exe 22 2764 rundll32.exe 26 2764 rundll32.exe 34 2764 rundll32.exe 38 2764 rundll32.exe 43 2764 rundll32.exe - Deletes itself 1 IoCs
pid Process 3868 imamj.exe - Executes dropped EXE 1 IoCs
pid Process 3868 imamj.exe - Loads dropped DLL 1 IoCs
pid Process 2764 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\dlthy\\ijnftzcr.dll\",Verify" rundll32.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\a: rundll32.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2764 rundll32.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\dlthy imamj.exe File created \??\c:\Program Files\dlthy\ijnftzcr.dll imamj.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3844 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2764 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2312 158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe 3868 imamj.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2312 wrote to memory of 1560 2312 158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe 83 PID 2312 wrote to memory of 1560 2312 158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe 83 PID 2312 wrote to memory of 1560 2312 158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe 83 PID 1560 wrote to memory of 3844 1560 cmd.exe 85 PID 1560 wrote to memory of 3844 1560 cmd.exe 85 PID 1560 wrote to memory of 3844 1560 cmd.exe 85 PID 1560 wrote to memory of 3868 1560 cmd.exe 87 PID 1560 wrote to memory of 3868 1560 cmd.exe 87 PID 1560 wrote to memory of 3868 1560 cmd.exe 87 PID 3868 wrote to memory of 2764 3868 imamj.exe 88 PID 3868 wrote to memory of 2764 3868 imamj.exe 88 PID 3868 wrote to memory of 2764 3868 imamj.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe"C:\Users\Admin\AppData\Local\Temp\158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\imamj.exe "C:\Users\Admin\AppData\Local\Temp\158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:3844
-
-
C:\Users\Admin\AppData\Local\Temp\imamj.exeC:\Users\Admin\AppData\Local\Temp\\imamj.exe "C:\Users\Admin\AppData\Local\Temp\158e1ff82b53c0025e9495f82ef55385578a607796b1bb790265cbc395dacf8b.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\dlthy\ijnftzcr.dll",Verify C:\Users\Admin\AppData\Local\Temp\imamj.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\imamj.exe
- Size 408KB
- SHA256 aa3218e685cc0a4351b1f6fabe30cbe75de5b940f7983ca4e7a56f578516debb
- MD5 5564e1bafcd7bdfff65503123df7bee9
- SHA1 5862c54e99c5ad0e5fe2fdb7cd5f43a8904a0e9b
- SHA512 6b2aadd187b7c997c0dab42cf889819561e2fdbc37fa5663ed9d8fd0bc36c37b3e38e15249b19c11e89d98a3bdc70c918024e07f4e335162a9dade2ec6ef7bf0
- SSDEEP 6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH40:gtRfJcNYFNm8UhlZGse0
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Program Files\dlthy\ijnftzcr.dll
- Size 228KB
- SHA256 b3b7785bb926f4c85ad41163a4430a9b4278173271c624c12928dbfa873889d4
- MD5 60398fcbf3b75cfa80cc32bac6ee6147
- SHA1 fa10fb11413d8d679cf5555ee51e324504c9474c
- SHA512 7f20a792164b08e3dbda9101d692079ea13beb26d5f83a8110a7e573e283a5650a11f4784debb565a76193f565f8cf11a1c51e5de892f911bbc2894840150862
- SSDEEP 6144:U1oEITTl5VCuHFrEy0wEOR7ndfAnVxERZ4CR3XaNe:5vVrHFrL05gdonVANpV
- MD5 SHA1 SHA512 SSDEEP