Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 11:35

General

  • Target

    $TEMP/51cdF_RQLr.dll

  • Size

    89KB

  • MD5

    7a06cb307f802c120609c0b3c1e963a9

  • SHA1

    2bda4b275422ea6138b12efaeefcb9e279f1de95

  • SHA256

    292340cb04147497e7828986c55765e24bc863ab8e3066b317d78032beab984a

  • SHA512

    a38c7cfb714859ddca000390bae3c4dc5a4cf88db2e974168bf1270b0740568630ce2afd63cb6b663c7df9296a97d2c0dbc0968b2eaaab74487cd179876752a6

  • SSDEEP

    1536:zglskiJV33LX+dJ52NZmihyR6cu4fiTUyrUpgWjAal+faohb:QoJ3KdJAbG6cu4OrUpgEAi+fZb

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\51cdF_RQLr.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\51cdF_RQLr.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /e:on /d /c ping -n 6 127.0.0.1 && DEL /F "C:\Users\Admin\AppData\Local\Temp\$TEMP\51cdF_RQLr.dll" >> nul
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 6 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2076-2-0x0000000000240000-0x0000000000254000-memory.dmp

    Filesize

    80KB

  • memory/2076-4-0x00000000002A0000-0x00000000002B4000-memory.dmp

    Filesize

    80KB

  • memory/2076-3-0x0000000000260000-0x0000000000279000-memory.dmp

    Filesize

    100KB

  • memory/2076-0-0x00000000002A0000-0x00000000002B4000-memory.dmp

    Filesize

    80KB

  • memory/2076-5-0x00000000002A0000-0x00000000002B4000-memory.dmp

    Filesize

    80KB