Analysis
-
max time kernel
207s -
max time network
212s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
12/10/2024, 03:15
General
-
Target
dllhost.exe
-
Size
37KB
-
MD5
0a64b72aff3b45b06dfee336414cf9ed
-
SHA1
5bc91466f6a8952dee430c976c206e5bf73890b7
-
SHA256
0b9081f030f73e047a09db602103c671753716f992163a47d6028f5aafc6e9c6
-
SHA512
d8a3435665ff21993332cf1f736abbc260539451e3e66e2b7c3b225431e99d1a774468f4b80e4a220ca19378ddc67a2913d45dddf5eba6f8027e9d6419fc51d7
-
SSDEEP
768:CXrtsKADtOHiR4akrYBQWllykrM+rMRa8NuW4t:CXr8tVSkBQWlEH+gRJNJ
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD50a64b72aff3b45b06dfee336414cf9ed
SHA15bc91466f6a8952dee430c976c206e5bf73890b7
SHA2560b9081f030f73e047a09db602103c671753716f992163a47d6028f5aafc6e9c6
SHA512d8a3435665ff21993332cf1f736abbc260539451e3e66e2b7c3b225431e99d1a774468f4b80e4a220ca19378ddc67a2913d45dddf5eba6f8027e9d6419fc51d7
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB