MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-18 17:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win7-20240611-en

Max time kernel

121s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ASUS_WMI.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2752 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2752 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2752 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2752 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2752 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2752 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2752 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ASUS_WMI.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ASUS_WMI.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 320

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

124s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-convert-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-convert-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4216,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	101.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	18.53.126.40.in-addr.arpa	udp
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

53s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\files\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\files\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\files\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\files\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3260 -ip 3260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3260 -ip 3260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 584

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	23.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	24.73.42.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-environment-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-environment-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	43.56.20.217.in-addr.arpa	udp
US	8.8.8.8:53		udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win7-20240611-en

Max time kernel

120s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\AsIO.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1476 wrote to memory of 2240	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1476 wrote to memory of 2240	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1476 wrote to memory of 2240	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1476 wrote to memory of 2240	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1476 wrote to memory of 2240	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1476 wrote to memory of 2240	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1476 wrote to memory of 2240	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\AsIO.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\AsIO.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\files\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\files\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\files\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\files\x86\VSLauncher_[0MB]_[1].exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
BE	2.17.107.107:443	www.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	107.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	52.111.227.11:443		tcp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	11.179.89.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-filesystem-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-filesystem-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

94s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-heap-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-heap-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
BE	88.221.83.226:443	www.bing.com	tcp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	74.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	226.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

96s

Max time network

143s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ATKEX.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 772 wrote to memory of 2456	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 772 wrote to memory of 2456	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 772 wrote to memory of 2456	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ATKEX.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ATKEX.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	71.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	21.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	43.56.20.217.in-addr.arpa	udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win7-20231129-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\files\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\files\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-util-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-util-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	20.231.121.79:80		tcp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.180.10:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	10.180.250.142.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	170.117.168.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\AsIO.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2448 wrote to memory of 1964	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2448 wrote to memory of 1964	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2448 wrote to memory of 1964	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\AsIO.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\AsIO.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
BE	2.17.107.113:443	www.bing.com	tcp
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	113.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win7-20240611-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2300 wrote to memory of 2908	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2300 wrote to memory of 2908	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2300 wrote to memory of 2908	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2300 wrote to memory of 2908	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2300 wrote to memory of 2908	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2300 wrote to memory of 2908	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2300 wrote to memory of 2908	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win7-20240611-en

Max time kernel

120s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140_app.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2916 wrote to memory of 2440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2916 wrote to memory of 2440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2916 wrote to memory of 2440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2916 wrote to memory of 2440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2916 wrote to memory of 2440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2916 wrote to memory of 2440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2916 wrote to memory of 2440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140_app.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-string-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-string-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	99.58.20.217.in-addr.arpa	udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

59s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Network

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

131s

Max time network

133s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-sysinfo-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-sysinfo-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	21.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	43.56.20.217.in-addr.arpa	udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-conio-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-crt-conio-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
BE	2.17.107.122:443	www.bing.com	tcp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	100.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	122.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	24.73.42.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win7-20240611-en

Max time kernel

119s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ATKEX.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2596 wrote to memory of 2788	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2596 wrote to memory of 2788	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2596 wrote to memory of 2788	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2596 wrote to memory of 2788	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2596 wrote to memory of 2788	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2596 wrote to memory of 2788	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2596 wrote to memory of 2788	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ATKEX.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ATKEX.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

79s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Reads data files stored by FTP clients

spyware stealer

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\dcom.au3	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2860 set thread context of 3400	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe

Checks installed software on the system

discovery

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation

Description	Indicator	Process	Target
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\dcom.au3	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2860 wrote to memory of 3400	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2860 wrote to memory of 3400	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2860 wrote to memory of 3400	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2860 wrote to memory of 3400	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3400 wrote to memory of 4760	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 3400 wrote to memory of 4760	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 3400 wrote to memory of 4760	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 3400 wrote to memory of 4760	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 3400 wrote to memory of 4760	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 4760 wrote to memory of 4332	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	C:\Windows\SysWOW64\cmd.exe
PID 4760 wrote to memory of 4332	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	C:\Windows\SysWOW64\cmd.exe
PID 4760 wrote to memory of 4332	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	C:\Windows\SysWOW64\cmd.exe
PID 4332 wrote to memory of 3136	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 4332 wrote to memory of 3136	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 4332 wrote to memory of 3136	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\files\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\files\Setup.exe" & rd /s /q "C:\ProgramData\HIEHDAFHDHCB" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	poocoin.online	udp
US	52.111.227.14:443		tcp

Files

memory/2860-0-0x00000000749C0000-0x0000000074B3B000-memory.dmp

memory/2860-1-0x00007FFFBC790000-0x00007FFFBC985000-memory.dmp

memory/2860-7-0x00000000749D2000-0x00000000749D4000-memory.dmp

memory/2860-8-0x00000000749C0000-0x0000000074B3B000-memory.dmp

memory/2860-9-0x00000000749C0000-0x0000000074B3B000-memory.dmp

memory/3400-11-0x00000000749C1000-0x00000000749CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9c911c0a

MD5	032340f6a039ad8f82b629aadcd85ebb
SHA1	64659a225699344156f6a42d699fd8167cfdfe7d
SHA256	2eecad24fedb31748d733699e7f9a32b6610d72b7956bd36239cd3281cf52ff5
SHA512	c427a0f18f1a23896224c1559da7c238da0dc301994dd15aaefbaad145e0cca6e5b57fe8e4d9d1f6391c288be103d41e776dd38714ee5ba5a6ca3b6d3ec6cc84

memory/3400-13-0x00007FFFBC790000-0x00007FFFBC985000-memory.dmp

memory/3400-16-0x00000000749C1000-0x00000000749CF000-memory.dmp

memory/3400-15-0x00000000749CE000-0x00000000749D0000-memory.dmp

memory/3400-20-0x00000000749C1000-0x00000000749CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dcom.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/4760-22-0x00000000012A0000-0x00000000019EC000-memory.dmp

memory/4760-24-0x00007FFFBC790000-0x00007FFFBC985000-memory.dmp

memory/4760-25-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4760-43-0x00000000012A0000-0x00000000019EC000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240226-en

Max time kernel

140s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1076 wrote to memory of 1612	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1076 wrote to memory of 1612	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1076 wrote to memory of 1612	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1612 -ip 1612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	159.185.200.23.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
GB	142.250.187.234:443		tcp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	13.107.246.64:443		tcp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	21.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	3.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

83s

Max time network

134s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
BE	88.221.83.186:443	www.bing.com	tcp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	186.83.221.88.in-addr.arpa	udp
US	52.182.143.211:443		tcp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	21.121.18.2.in-addr.arpa	udp
PL	93.184.221.240:80		tcp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

115s

Max time network

138s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4172,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	9.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win7-20240221-en

Max time kernel

149s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2932 set thread context of 1944	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2932 wrote to memory of 1944	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2932 wrote to memory of 1944	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2932 wrote to memory of 1944	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2932 wrote to memory of 1944	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2932 wrote to memory of 1944	N/A	C:\Users\Admin\AppData\Local\Temp\files\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 1944 wrote to memory of 2820	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1944 wrote to memory of 2820	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1944 wrote to memory of 2820	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1944 wrote to memory of 2820	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1944 wrote to memory of 2820	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1944 wrote to memory of 2820	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 2820 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2820 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2820 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2820 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\dcom.au3	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\files\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 148

Network

N/A

Files

memory/2932-0-0x00000000745C0000-0x0000000074734000-memory.dmp

memory/2932-1-0x0000000077260000-0x0000000077409000-memory.dmp

memory/2932-7-0x00000000745D2000-0x00000000745D4000-memory.dmp

memory/2932-8-0x00000000745C0000-0x0000000074734000-memory.dmp

memory/2932-9-0x00000000745C0000-0x0000000074734000-memory.dmp

memory/1944-11-0x00000000745C0000-0x0000000074734000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\96cc5e6e

MD5	aa6bece1bc10def704a1ad965f3ab1c9
SHA1	71cfe49c855a3f04919efd73a72e23e0e6e5f66a
SHA256	7a4409ec058316a75aab661e10b6b3b1b305811a28e052cb1cbfb289beb21566
SHA512	98b4c08092d9518565dba4aa418343db9b0b0b131e2b5736ccc94dc4ee680aaf9d8db0e6162760becf8a658bd613429717a4e5daeccb37b251e2482bab6fe06f

memory/1944-13-0x0000000077260000-0x0000000077409000-memory.dmp

memory/1944-15-0x00000000745C0000-0x0000000074734000-memory.dmp

memory/1944-16-0x00000000745C0000-0x0000000074734000-memory.dmp

\Users\Admin\AppData\Local\Temp\dcom.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2820-22-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2820-21-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1944-23-0x00000000745C0000-0x0000000074734000-memory.dmp

memory/2820-25-0x00000000006F0000-0x0000000000E3C000-memory.dmp

memory/2820-32-0x00000000006F0000-0x0000000000E3C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ASUS_WMI.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1180 wrote to memory of 5032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1180 wrote to memory of 5032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1180 wrote to memory of 5032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ASUS_WMI.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ASUS_WMI.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5032 -ip 5032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 572

Network

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240611-en

Max time kernel

93s

Max time network

143s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3748 wrote to memory of 4300	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3748 wrote to memory of 4300	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3748 wrote to memory of 4300	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4300 -ip 4300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 600

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	75.159.190.20.in-addr.arpa	udp
BE	88.221.83.250:443	www.bing.com	tcp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	250.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\files\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\files\x86\HDHelper_[0MB]_[1].exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win7-20240221-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\files\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\files\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-18 17:19

Reported

2024-06-18 17:21

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-timezone-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\x86\api-ms-win-core-timezone-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	36.56.20.217.in-addr.arpa	udp
US	8.8.8.8:53	68.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	174.117.168.52.in-addr.arpa	udp

Files

N/A

Sample ID	240618-vvtjwasfjh
Target	6ba9d7cfc6378cdeeb2006a0cf9014c9a10bb3f1d480bebc435de97307868d7c.zip
SHA256	6ba9d7cfc6378cdeeb2006a0cf9014c9a10bb3f1d480bebc435de97307868d7c
Tags	stealc vidar discovery persistence privilege_escalation spyware stealer

Malware Analysis Report

2024-09-11 16:13

Table of Contents