Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 16:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a4c4787a49fea86e5efcf4f25756691739986a03d33ae56aeafa0f7d9390986N.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
9a4c4787a49fea86e5efcf4f25756691739986a03d33ae56aeafa0f7d9390986N.dll
-
Size
72KB
-
MD5
e4e0f1e906438fa35d1fba77c103f7a0
-
SHA1
5d8982e0044de448851ef215756fa32acc8b12c1
-
SHA256
9a4c4787a49fea86e5efcf4f25756691739986a03d33ae56aeafa0f7d9390986
-
SHA512
f408601cce851e4fefefffec7dbd38d7e0e77ff4ac86aef7ad44a571c8d11887129a53ecf871e6cf4a17b276e5f5ea3b4f710cebbad1ef17ef9ea91115eb3f9d
-
SSDEEP
768:lojY9PtWmb1MwqHmwmsZMpRwqKbGhPRDUsoRyHKVojY9PO56KDPHc9IPv2tBUFq0:wm1WKTqHmkhGPoRyHKAmE8IP0+MYHMm
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1740 hrl81EC.tmp 2716 zqhjao.exe -
Loads dropped DLL 2 IoCs
pid Process 1632 rundll32.exe 1632 rundll32.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\X: rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\zqhjao.exe hrl81EC.tmp File opened for modification C:\Windows\SysWOW64\zqhjao.exe hrl81EC.tmp -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1740 hrl81EC.tmp 2716 zqhjao.exe -
Suspicious behavior: MapViewOfSection 51 IoCs
pid Process 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 1740 hrl81EC.tmp 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe 2716 zqhjao.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1740 hrl81EC.tmp Token: SeDebugPrivilege 2716 zqhjao.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 1632 1792 rundll32.exe 30 PID 1792 wrote to memory of 1632 1792 rundll32.exe 30 PID 1792 wrote to memory of 1632 1792 rundll32.exe 30 PID 1792 wrote to memory of 1632 1792 rundll32.exe 30 PID 1792 wrote to memory of 1632 1792 rundll32.exe 30 PID 1792 wrote to memory of 1632 1792 rundll32.exe 30 PID 1792 wrote to memory of 1632 1792 rundll32.exe 30 PID 1632 wrote to memory of 1740 1632 rundll32.exe 31 PID 1632 wrote to memory of 1740 1632 rundll32.exe 31 PID 1632 wrote to memory of 1740 1632 rundll32.exe 31 PID 1632 wrote to memory of 1740 1632 rundll32.exe 31 PID 1740 wrote to memory of 384 1740 hrl81EC.tmp 3 PID 1740 wrote to memory of 384 1740 hrl81EC.tmp 3 PID 1740 wrote to memory of 384 1740 hrl81EC.tmp 3 PID 1740 wrote to memory of 384 1740 hrl81EC.tmp 3 PID 1740 wrote to memory of 384 1740 hrl81EC.tmp 3 PID 1740 wrote to memory of 384 1740 hrl81EC.tmp 3 PID 1740 wrote to memory of 384 1740 hrl81EC.tmp 3 PID 1740 wrote to memory of 392 1740 hrl81EC.tmp 4 PID 1740 wrote to memory of 392 1740 hrl81EC.tmp 4 PID 1740 wrote to memory of 392 1740 hrl81EC.tmp 4 PID 1740 wrote to memory of 392 1740 hrl81EC.tmp 4 PID 1740 wrote to memory of 392 1740 hrl81EC.tmp 4 PID 1740 wrote to memory of 392 1740 hrl81EC.tmp 4 PID 1740 wrote to memory of 392 1740 hrl81EC.tmp 4 PID 1740 wrote to memory of 432 1740 hrl81EC.tmp 5 PID 1740 wrote to memory of 432 1740 hrl81EC.tmp 5 PID 1740 wrote to memory of 432 1740 hrl81EC.tmp 5 PID 1740 wrote to memory of 432 1740 hrl81EC.tmp 5 PID 1740 wrote to memory of 432 1740 hrl81EC.tmp 5 PID 1740 wrote to memory of 432 1740 hrl81EC.tmp 5 PID 1740 wrote to memory of 432 1740 hrl81EC.tmp 5 PID 1740 wrote to memory of 476 1740 hrl81EC.tmp 6 PID 1740 wrote to memory of 476 1740 hrl81EC.tmp 6 PID 1740 wrote to memory of 476 1740 hrl81EC.tmp 6 PID 1740 wrote to memory of 476 1740 hrl81EC.tmp 6 PID 1740 wrote to memory of 476 1740 hrl81EC.tmp 6 PID 1740 wrote to memory of 476 1740 hrl81EC.tmp 6 PID 1740 wrote to memory of 476 1740 hrl81EC.tmp 6 PID 1740 wrote to memory of 492 1740 hrl81EC.tmp 7 PID 1740 wrote to memory of 492 1740 hrl81EC.tmp 7 PID 1740 wrote to memory of 492 1740 hrl81EC.tmp 7 PID 1740 wrote to memory of 492 1740 hrl81EC.tmp 7 PID 1740 wrote to memory of 492 1740 hrl81EC.tmp 7 PID 1740 wrote to memory of 492 1740 hrl81EC.tmp 7 PID 1740 wrote to memory of 492 1740 hrl81EC.tmp 7 PID 1740 wrote to memory of 500 1740 hrl81EC.tmp 8 PID 1740 wrote to memory of 500 1740 hrl81EC.tmp 8 PID 1740 wrote to memory of 500 1740 hrl81EC.tmp 8 PID 1740 wrote to memory of 500 1740 hrl81EC.tmp 8 PID 1740 wrote to memory of 500 1740 hrl81EC.tmp 8 PID 1740 wrote to memory of 500 1740 hrl81EC.tmp 8 PID 1740 wrote to memory of 500 1740 hrl81EC.tmp 8 PID 1740 wrote to memory of 592 1740 hrl81EC.tmp 9 PID 1740 wrote to memory of 592 1740 hrl81EC.tmp 9 PID 1740 wrote to memory of 592 1740 hrl81EC.tmp 9 PID 1740 wrote to memory of 592 1740 hrl81EC.tmp 9 PID 1740 wrote to memory of 592 1740 hrl81EC.tmp 9 PID 1740 wrote to memory of 592 1740 hrl81EC.tmp 9 PID 1740 wrote to memory of 592 1740 hrl81EC.tmp 9 PID 1740 wrote to memory of 672 1740 hrl81EC.tmp 10 PID 1740 wrote to memory of 672 1740 hrl81EC.tmp 10 PID 1740 wrote to memory of 672 1740 hrl81EC.tmp 10 PID 1740 wrote to memory of 672 1740 hrl81EC.tmp 10
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1616
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:284
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:740
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1128
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:856
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:964
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:112
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1056
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1064
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1500
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2496
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2132
-
-
C:\Windows\SysWOW64\zqhjao.exeC:\Windows\SysWOW64\zqhjao.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1152
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a4c4787a49fea86e5efcf4f25756691739986a03d33ae56aeafa0f7d9390986N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a4c4787a49fea86e5efcf4f25756691739986a03d33ae56aeafa0f7d9390986N.dll,#13⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\hrl81EC.tmpC:\Users\Admin\AppData\Local\Temp\hrl81EC.tmp4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD51f81e70bc60fb2712c8928f26688adf8
SHA17eaa7e4abda610aaab718dd799441660b6a34c0e
SHA256aa6d81577abe367a6d9614569ab0ff6e519a8d4b5c9206c9414f5a2ce7307ca0
SHA5121fb02af2229690b3e8ec7b6b677d368fe7e7205c15427f99f62b4fb2f10677e67cccb4830c65c89d838bd490c0cdc16595aaffa81bfe971023882ed138aa101f