Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 08:06
Behavioral task
behavioral1
Sample
Untitled1.dll
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
Untitled1.dll
-
Size
127KB
-
MD5
98ff16a8b3e5534e8b5223504cb6af09
-
SHA1
e77a81455cdf2768f6de4f9cbdd84da168338115
-
SHA256
7d214c22042b34d5e3558d7080bacece92f5375a4b03a2b9bd7fd5404fe862f4
-
SHA512
774534e132a5f7285ff015dada02e5196c4fcab4aa4a6a8d032d8da9942fcb4edb9462a654f4cbba64f84b78450c48da05e425d4a7abe750bf504ded6476ee74
-
SSDEEP
3072:OMbIWiyr7pjvTooBFEbWwIUclTBft3+oTs:OCIWiyr7JHn17lTBl3+oo
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\unufkdjv.exe rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\mhdsadaf\px1870.tmp rundll32.exe File opened for modification C:\Program Files (x86)\mhdsadaf\unufkdjv.exe rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 616 wrote to memory of 1940 616 rundll32.exe 28 PID 616 wrote to memory of 1940 616 rundll32.exe 28 PID 616 wrote to memory of 1940 616 rundll32.exe 28 PID 616 wrote to memory of 1940 616 rundll32.exe 28 PID 616 wrote to memory of 1940 616 rundll32.exe 28 PID 616 wrote to memory of 1940 616 rundll32.exe 28 PID 616 wrote to memory of 1940 616 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Untitled1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Untitled1.dll,#12⤵
- Checks BIOS information in registry
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1940
-