Analysis

  • max time kernel
    117s
  • max time network
    84s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    16-08-2024 02:31

General

  • Target

    bb0d1e8f3446f47e4cd59abfb08af930N.dll

  • Size

    80KB

  • MD5

    bb0d1e8f3446f47e4cd59abfb08af930

  • SHA1

    3605a8d0748e0135cd3cef9c85fe7a36fa64de2d

  • SHA256

    c8e55a8562af00cbc28c55b00beaf6a9bcf8d0b2187044df97eaef3fe0638731

  • SHA512

    e57f4dfe24656ba4952a8771bbbc0314107dd350deffc17d51145909bf99e80be1dab0b9762d0037440e588d74de24fbd6fd611245c98ded8db79a2748008809

  • SSDEEP

    1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPE47:5dbwovEVyqgoZmZXWfIdQdRaefPN7

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 9 IoCs

    Attempt to gather information on host's network.

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb0d1e8f3446f47e4cd59abfb08af930N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb0d1e8f3446f47e4cd59abfb08af930N.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1448
      • C:\Windows\SysWOW64\arp.exe
        arp -a
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2156
      • C:\Windows\SysWOW64\arp.exe
        arp -s 10.127.0.1 08-3f-3f-fb-f1-5d
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1936
      • C:\Windows\SysWOW64\arp.exe
        arp -s 10.127.255.255 a9-00-b7-59-21-bd
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:2160
      • C:\Windows\SysWOW64\arp.exe
        arp -s 136.243.76.173 90-5f-f7-3c-c6-16
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2100
      • C:\Windows\SysWOW64\arp.exe
        arp -s 224.0.0.22 79-de-5a-77-66-30
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1792
      • C:\Windows\SysWOW64\arp.exe
        arp -s 224.0.0.251 3c-0f-12-d7-e3-23
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:2512
      • C:\Windows\SysWOW64\arp.exe
        arp -s 224.0.0.252 2d-f5-da-6d-e5-b8
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2372
      • C:\Windows\SysWOW64\arp.exe
        arp -s 239.255.255.250 e4-97-9d-d5-ea-df
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2540
      • C:\Windows\SysWOW64\arp.exe
        arp -s 255.255.255.255 a7-b3-63-bc-9a-be
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2392
      • C:\Windows\SysWOW64\arp.exe
        arp -d
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1448-0-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1448-2-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1448-3-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1448-1-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1448-46-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1448-44-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1448-38-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1448-37-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1448-32-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1448-31-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1792-14-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1936-9-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1936-25-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2100-29-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2100-18-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2156-4-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2156-6-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2160-7-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2160-12-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2372-8-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2372-17-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2392-26-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2392-16-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2512-13-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2512-22-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2540-21-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2540-10-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2600-34-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2600-36-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB