Analysis
-
max time kernel
117s -
max time network
84s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16-08-2024 02:31
Behavioral task
behavioral1
Sample
bb0d1e8f3446f47e4cd59abfb08af930N.dll
Resource
win7-20240705-en
General
-
Target
bb0d1e8f3446f47e4cd59abfb08af930N.dll
-
Size
80KB
-
MD5
bb0d1e8f3446f47e4cd59abfb08af930
-
SHA1
3605a8d0748e0135cd3cef9c85fe7a36fa64de2d
-
SHA256
c8e55a8562af00cbc28c55b00beaf6a9bcf8d0b2187044df97eaef3fe0638731
-
SHA512
e57f4dfe24656ba4952a8771bbbc0314107dd350deffc17d51145909bf99e80be1dab0b9762d0037440e588d74de24fbd6fd611245c98ded8db79a2748008809
-
SSDEEP
1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPE47:5dbwovEVyqgoZmZXWfIdQdRaefPN7
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 5 1448 rundll32.exe 8 1448 rundll32.exe 9 1448 rundll32.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
resource yara_rule behavioral1/memory/1448-0-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1448-2-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1448-3-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2156-4-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2156-6-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2160-7-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2100-18-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2392-26-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1936-25-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2512-22-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2540-21-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2372-17-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2392-16-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1792-14-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2160-12-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2540-10-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1936-9-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2512-13-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2372-8-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2100-29-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1448-31-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1448-32-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2600-34-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2600-36-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1448-37-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1448-38-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1448-44-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1448-46-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: rundll32.exe -
pid Process 2156 arp.exe 1936 arp.exe 2100 arp.exe 1792 arp.exe 2512 arp.exe 2540 arp.exe 2392 arp.exe 2160 arp.exe 2372 arp.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1448 rundll32.exe 1448 rundll32.exe 1448 rundll32.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 472 Process not Found 472 Process not Found -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 1448 rundll32.exe Token: SeDebugPrivilege 2156 arp.exe Token: SeDebugPrivilege 2372 arp.exe Token: SeDebugPrivilege 2392 arp.exe Token: SeDebugPrivilege 1792 arp.exe Token: SeDebugPrivilege 2540 arp.exe Token: SeDebugPrivilege 1936 arp.exe Token: SeDebugPrivilege 2100 arp.exe Token: SeDebugPrivilege 2600 arp.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1448 1320 rundll32.exe 30 PID 1320 wrote to memory of 1448 1320 rundll32.exe 30 PID 1320 wrote to memory of 1448 1320 rundll32.exe 30 PID 1320 wrote to memory of 1448 1320 rundll32.exe 30 PID 1320 wrote to memory of 1448 1320 rundll32.exe 30 PID 1320 wrote to memory of 1448 1320 rundll32.exe 30 PID 1320 wrote to memory of 1448 1320 rundll32.exe 30 PID 1448 wrote to memory of 2156 1448 rundll32.exe 31 PID 1448 wrote to memory of 2156 1448 rundll32.exe 31 PID 1448 wrote to memory of 2156 1448 rundll32.exe 31 PID 1448 wrote to memory of 2156 1448 rundll32.exe 31 PID 1448 wrote to memory of 1936 1448 rundll32.exe 33 PID 1448 wrote to memory of 1936 1448 rundll32.exe 33 PID 1448 wrote to memory of 1936 1448 rundll32.exe 33 PID 1448 wrote to memory of 1936 1448 rundll32.exe 33 PID 1448 wrote to memory of 2160 1448 rundll32.exe 34 PID 1448 wrote to memory of 2160 1448 rundll32.exe 34 PID 1448 wrote to memory of 2160 1448 rundll32.exe 34 PID 1448 wrote to memory of 2160 1448 rundll32.exe 34 PID 1448 wrote to memory of 2100 1448 rundll32.exe 35 PID 1448 wrote to memory of 2100 1448 rundll32.exe 35 PID 1448 wrote to memory of 2100 1448 rundll32.exe 35 PID 1448 wrote to memory of 2100 1448 rundll32.exe 35 PID 1448 wrote to memory of 1792 1448 rundll32.exe 36 PID 1448 wrote to memory of 1792 1448 rundll32.exe 36 PID 1448 wrote to memory of 1792 1448 rundll32.exe 36 PID 1448 wrote to memory of 1792 1448 rundll32.exe 36 PID 1448 wrote to memory of 2512 1448 rundll32.exe 37 PID 1448 wrote to memory of 2512 1448 rundll32.exe 37 PID 1448 wrote to memory of 2512 1448 rundll32.exe 37 PID 1448 wrote to memory of 2512 1448 rundll32.exe 37 PID 1448 wrote to memory of 2372 1448 rundll32.exe 38 PID 1448 wrote to memory of 2372 1448 rundll32.exe 38 PID 1448 wrote to memory of 2372 1448 rundll32.exe 38 PID 1448 wrote to memory of 2372 1448 rundll32.exe 38 PID 1448 wrote to memory of 2540 1448 rundll32.exe 39 PID 1448 wrote to memory of 2540 1448 rundll32.exe 39 PID 1448 wrote to memory of 2540 1448 rundll32.exe 39 PID 1448 wrote to memory of 2540 1448 rundll32.exe 39 PID 1448 wrote to memory of 2392 1448 rundll32.exe 40 PID 1448 wrote to memory of 2392 1448 rundll32.exe 40 PID 1448 wrote to memory of 2392 1448 rundll32.exe 40 PID 1448 wrote to memory of 2392 1448 rundll32.exe 40 PID 1448 wrote to memory of 2600 1448 rundll32.exe 50 PID 1448 wrote to memory of 2600 1448 rundll32.exe 50 PID 1448 wrote to memory of 2600 1448 rundll32.exe 50 PID 1448 wrote to memory of 2600 1448 rundll32.exe 50
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bb0d1e8f3446f47e4cd59abfb08af930N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bb0d1e8f3446f47e4cd59abfb08af930N.dll,#12⤵
- Blocklisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 08-3f-3f-fb-f1-5d3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 a9-00-b7-59-21-bd3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2160
-
-
C:\Windows\SysWOW64\arp.exearp -s 136.243.76.173 90-5f-f7-3c-c6-163⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 79-de-5a-77-66-303⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 3c-0f-12-d7-e3-233⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2512
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 2d-f5-da-6d-e5-b83⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 e4-97-9d-d5-ea-df3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 a7-b3-63-bc-9a-be3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\SysWOW64\arp.exearp -d3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-