Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29-08-2024 19:14
Behavioral task
behavioral1
Sample
2637c4620bc7402a82e2bf796d91519fabaaabd8d8833894b227a94733ef28b2.dll
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
General
-
Target
2637c4620bc7402a82e2bf796d91519fabaaabd8d8833894b227a94733ef28b2.dll
-
Size
1020KB
-
MD5
5376d5072d2ccba215af9133c0324d17
-
SHA1
6b9d6cd3469f051f9a2934ed1630dce4458b4786
-
SHA256
2637c4620bc7402a82e2bf796d91519fabaaabd8d8833894b227a94733ef28b2
-
SHA512
cc2da832de5afe8dac1af5f680423e69acf05cabcae42462fce374ac1f736604e05a5936f417073bde3791050baec3ebe602f14a7584448128547d00b3d7d682
-
SSDEEP
24576:VdNqxOmV75VgTf/K43Xb/Is8kBCkr1Hx1qY1L+KPHO7JhhH5V+:KV7Ef/KcXUs8kBZJHiOL+KPHO7h5o
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Éù¿¨Çý¶¯²å¼þ.lnk rundll32.exe -
resource yara_rule behavioral1/memory/2408-1-0x0000000010000000-0x0000000010384000-memory.dmp vmprotect behavioral1/memory/2408-0-0x0000000010000000-0x0000000010384000-memory.dmp vmprotect behavioral1/memory/2408-2-0x0000000010000000-0x0000000010384000-memory.dmp vmprotect behavioral1/memory/2408-4-0x0000000010000000-0x0000000010384000-memory.dmp vmprotect behavioral1/memory/2408-76-0x0000000010000000-0x0000000010384000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Éù¿¨Çý¶¯ = "C:\\Windows\\SysWOW64\\rundll32.exe" rundll32.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\Z: rundll32.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2408 set thread context of 1504 2408 rundll32.exe 31 PID 2408 set thread context of 2920 2408 rundll32.exe 32 PID 2408 set thread context of 796 2408 rundll32.exe 33 PID 2408 set thread context of 2896 2408 rundll32.exe 34 PID 2408 set thread context of 2504 2408 rundll32.exe 35 PID 2408 set thread context of 2924 2408 rundll32.exe 36 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 1504 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2504 rundll32.exe 2896 rundll32.exe 2504 rundll32.exe 2896 rundll32.exe 2504 rundll32.exe 2896 rundll32.exe 2504 rundll32.exe 2504 rundll32.exe 2896 rundll32.exe 2504 rundll32.exe 2896 rundll32.exe 2504 rundll32.exe 2896 rundll32.exe 2504 rundll32.exe 2896 rundll32.exe 2504 rundll32.exe 2504 rundll32.exe 2896 rundll32.exe 2504 rundll32.exe 2896 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: 33 1504 rundll32.exe Token: SeIncBasePriorityPrivilege 1504 rundll32.exe Token: 33 796 rundll32.exe Token: SeIncBasePriorityPrivilege 796 rundll32.exe Token: 33 2504 rundll32.exe Token: SeIncBasePriorityPrivilege 2504 rundll32.exe Token: 33 2896 rundll32.exe Token: SeIncBasePriorityPrivilege 2896 rundll32.exe Token: 33 2920 rundll32.exe Token: SeIncBasePriorityPrivilege 2920 rundll32.exe Token: 33 2924 rundll32.exe Token: SeIncBasePriorityPrivilege 2924 rundll32.exe Token: 33 1504 rundll32.exe Token: SeIncBasePriorityPrivilege 1504 rundll32.exe Token: 33 796 rundll32.exe Token: SeIncBasePriorityPrivilege 796 rundll32.exe Token: 33 2504 rundll32.exe Token: SeIncBasePriorityPrivilege 2504 rundll32.exe Token: 33 2896 rundll32.exe Token: SeIncBasePriorityPrivilege 2896 rundll32.exe Token: 33 2920 rundll32.exe Token: SeIncBasePriorityPrivilege 2920 rundll32.exe Token: 33 2924 rundll32.exe Token: SeIncBasePriorityPrivilege 2924 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2408 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2408 2540 rundll32.exe 30 PID 2540 wrote to memory of 2408 2540 rundll32.exe 30 PID 2540 wrote to memory of 2408 2540 rundll32.exe 30 PID 2540 wrote to memory of 2408 2540 rundll32.exe 30 PID 2540 wrote to memory of 2408 2540 rundll32.exe 30 PID 2540 wrote to memory of 2408 2540 rundll32.exe 30 PID 2540 wrote to memory of 2408 2540 rundll32.exe 30 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 1504 2408 rundll32.exe 31 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 2920 2408 rundll32.exe 32 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 796 2408 rundll32.exe 33 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2896 2408 rundll32.exe 34 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2504 2408 rundll32.exe 35 PID 2408 wrote to memory of 2924 2408 rundll32.exe 36 PID 2408 wrote to memory of 2924 2408 rundll32.exe 36
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2637c4620bc7402a82e2bf796d91519fabaaabd8d8833894b227a94733ef28b2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2637c4620bc7402a82e2bf796d91519fabaaabd8d8833894b227a94733ef28b2.dll,#12⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-