1b02bcc9d21169fd3a1aa5c0d850e64c21a7058b3f1f73051649c1380dbe2a22

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b02bcc9d21169fd3a1aa5c0d850e64c21a7058b3f1f73051649c1380dbe2a22.dll
Size

431KB
MD5

9166534777bc9c0a4aa936345e68aa0a
SHA1

37904f4d2b3429df206e12faa83ff48e681c43cb
SHA256

1b02bcc9d21169fd3a1aa5c0d850e64c21a7058b3f1f73051649c1380dbe2a22
SHA512

c7cea093bdf27421a9b03e888968761fc91317d741f1254ffbcb1f9d20cc3fc9b5377e148d89f36192b43c55b3fc0a047091ecb8967b3a28012a124869fa04ec
SSDEEP

12288:IXi0ig1VCpPgYO+TqxeqFcOH72olHki9i:IXivg1VCpZOCqxkOH7TB0

Score

10^/10

discovery upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 27 IoCs

description	pid	Process	procid_target
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5
PID 3148 created 612	3148	rundll32.exe	5

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3148-0-0x0000000010000000-0x0000000010088000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3148	rundll32.exe
3148	rundll32.exe
3148	rundll32.exe
3148	rundll32.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe
Token: SeDebugPrivilege	3148	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 3148	4156	rundll32.exe	85
PID 4156 wrote to memory of 3148	4156	rundll32.exe	85
PID 4156 wrote to memory of 3148	4156	rundll32.exe	85
PID 3148 wrote to memory of 1776	3148	rundll32.exe	86
PID 3148 wrote to memory of 1776	3148	rundll32.exe	86
PID 3148 wrote to memory of 1776	3148	rundll32.exe	86
PID 3148 wrote to memory of 1948	3148	rundll32.exe	87
PID 3148 wrote to memory of 1948	3148	rundll32.exe	87
PID 3148 wrote to memory of 1948	3148	rundll32.exe	87
PID 3148 wrote to memory of 4068	3148	rundll32.exe	88
PID 3148 wrote to memory of 4068	3148	rundll32.exe	88
PID 3148 wrote to memory of 4068	3148	rundll32.exe	88
PID 3148 wrote to memory of 1964	3148	rundll32.exe	89
PID 3148 wrote to memory of 1964	3148	rundll32.exe	89
PID 3148 wrote to memory of 1964	3148	rundll32.exe	89
PID 3148 wrote to memory of 2172	3148	rundll32.exe	90
PID 3148 wrote to memory of 2172	3148	rundll32.exe	90
PID 3148 wrote to memory of 2172	3148	rundll32.exe	90
PID 3148 wrote to memory of 4208	3148	rundll32.exe	91
PID 3148 wrote to memory of 4208	3148	rundll32.exe	91
PID 3148 wrote to memory of 4208	3148	rundll32.exe	91
PID 3148 wrote to memory of 3380	3148	rundll32.exe	92
PID 3148 wrote to memory of 3380	3148	rundll32.exe	92
PID 3148 wrote to memory of 3380	3148	rundll32.exe	92
PID 3148 wrote to memory of 936	3148	rundll32.exe	93
PID 3148 wrote to memory of 936	3148	rundll32.exe	93
PID 3148 wrote to memory of 936	3148	rundll32.exe	93
PID 3148 wrote to memory of 1912	3148	rundll32.exe	94
PID 3148 wrote to memory of 1912	3148	rundll32.exe	94
PID 3148 wrote to memory of 1912	3148	rundll32.exe	94
PID 3148 wrote to memory of 3016	3148	rundll32.exe	95
PID 3148 wrote to memory of 3016	3148	rundll32.exe	95
PID 3148 wrote to memory of 3016	3148	rundll32.exe	95
PID 3148 wrote to memory of 3924	3148	rundll32.exe	96
PID 3148 wrote to memory of 3924	3148	rundll32.exe	96
PID 3148 wrote to memory of 3924	3148	rundll32.exe	96
PID 3148 wrote to memory of 3532	3148	rundll32.exe	97
PID 3148 wrote to memory of 3532	3148	rundll32.exe	97
PID 3148 wrote to memory of 3532	3148	rundll32.exe	97
PID 3148 wrote to memory of 4380	3148	rundll32.exe	98
PID 3148 wrote to memory of 4380	3148	rundll32.exe	98
PID 3148 wrote to memory of 4380	3148	rundll32.exe	98
PID 3148 wrote to memory of 3352	3148	rundll32.exe	99
PID 3148 wrote to memory of 3352	3148	rundll32.exe	99
PID 3148 wrote to memory of 3352	3148	rundll32.exe	99
PID 3148 wrote to memory of 876	3148	rundll32.exe	100
PID 3148 wrote to memory of 876	3148	rundll32.exe	100
PID 3148 wrote to memory of 876	3148	rundll32.exe	100
PID 3148 wrote to memory of 3304	3148	rundll32.exe	101
PID 3148 wrote to memory of 3304	3148	rundll32.exe	101
PID 3148 wrote to memory of 3304	3148	rundll32.exe	101
PID 3148 wrote to memory of 5004	3148	rundll32.exe	102
PID 3148 wrote to memory of 5004	3148	rundll32.exe	102
PID 3148 wrote to memory of 5004	3148	rundll32.exe	102
PID 3148 wrote to memory of 116	3148	rundll32.exe	103
PID 3148 wrote to memory of 116	3148	rundll32.exe	103
PID 3148 wrote to memory of 116	3148	rundll32.exe	103
PID 3148 wrote to memory of 5096	3148	rundll32.exe	104
PID 3148 wrote to memory of 5096	3148	rundll32.exe	104
PID 3148 wrote to memory of 5096	3148	rundll32.exe	104
PID 3148 wrote to memory of 4092	3148	rundll32.exe	105
PID 3148 wrote to memory of 4092	3148	rundll32.exe	105
PID 3148 wrote to memory of 4092	3148	rundll32.exe	105
PID 3148 wrote to memory of 2624	3148	rundll32.exe	106

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:1776
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:1948
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:4068
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:1964
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:2172
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:4208
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:3380
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:936
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:1912
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:3016
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:3924
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:3532
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:4380
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:3352
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:876
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:3304
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:5004
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:116
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:5096
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:4092
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:2624
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:2332
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:2044
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:4628
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:3296
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:3260
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:3284

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b02bcc9d21169fd3a1aa5c0d850e64c21a7058b3f1f73051649c1380dbe2a22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b02bcc9d21169fd3a1aa5c0d850e64c21a7058b3f1f73051649c1380dbe2a22.dll,#1
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3148-0-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download