Analysis
-
max time kernel
136s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2024 16:46
Behavioral task
behavioral1
Sample
921b0badeaffee860310e6755769337e.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
921b0badeaffee860310e6755769337e.dll
Resource
win10v2004-20241007-en
General
-
Target
921b0badeaffee860310e6755769337e.dll
-
Size
1.0MB
-
MD5
921b0badeaffee860310e6755769337e
-
SHA1
cfe2dfe5f457383e1723e4423e78620cc9fa8f91
-
SHA256
c9914b4ab252e782b73ab0a3efad386444ba8a8059167adcb0675968da2df36f
-
SHA512
2035442326a8e1f9733fef189cd135ce7b2dd22deda62d74e99ffd7eb83413487b91d72dba47f5512e4adcd45998ff5680a4b75342bba4c43d34186eacce1120
-
SSDEEP
24576:KNFxrUgNQWcPb72kXGWjVcwBlTd8DKT/VSMsCdTzHpgaym9:KNFxogmf2scG1Tzcm9
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 4 924 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
pid Process 4444 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1396 netsh.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 924 rundll32.exe 924 rundll32.exe 924 rundll32.exe 924 rundll32.exe 924 rundll32.exe 924 rundll32.exe 924 rundll32.exe 924 rundll32.exe 924 rundll32.exe 924 rundll32.exe 4444 powershell.exe 4444 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4444 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 540 wrote to memory of 924 540 rundll32.exe 84 PID 540 wrote to memory of 924 540 rundll32.exe 84 PID 540 wrote to memory of 924 540 rundll32.exe 84 PID 924 wrote to memory of 1396 924 rundll32.exe 85 PID 924 wrote to memory of 1396 924 rundll32.exe 85 PID 924 wrote to memory of 1396 924 rundll32.exe 85 PID 924 wrote to memory of 4444 924 rundll32.exe 90 PID 924 wrote to memory of 4444 924 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\921b0badeaffee860310e6755769337e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\921b0badeaffee860310e6755769337e.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1396
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\878641211696_Desktop.zip' -CompressionLevel Optimal3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
290KB
MD556e8420544e694270ae57df892290d70
SHA133c724b071570991a40efeaaeaa7477ef56c81c4
SHA2568adfb8a9a9840c80dcdd4b448e8a7a9f0bceb495005aebebe37e9188c44bfebb
SHA512fa9a4c3f59eb998c92f92a3ba8020b18d654b552d9bcba4c50c52ca42c4a7e7b3c67c9c08ece14bbea7c0a2071de8ad624597225e3ddfae358e937ec96fbebbb
-
Filesize
14KB
MD50959505c756e4a90411959af06976394
SHA1d7e1c654e1ef0344963ca06a6ae76917ec0538b8
SHA25628a747f8f6f6ec46fd6431363a8b00f93089be6357c5cfa38691c86b6a761cce
SHA5123820eeb7ba2ba0aa7bf24733ec589a9ca5a8509c11fc4b1e80c1ff1c7b96e14c6d2a20af497eb8d08bb0f2b930ff3ca4138004801a476557b7346189e109e25d
-
Filesize
147KB
MD5707fc2f47604860e71d5cbe886950b02
SHA1cadcfa7605c33bfd53e647c432e2428716e284f5
SHA256f7f5c943f7e990e8e0e692e55a2a8dc324f41cbe61d2b010a05a2978ace1fd44
SHA512d24f2c80ec9b9a9a77fd392f329f5006b047686de976b3e3b71d8f9809c95d6367b9c5529880e841625970430df82c263c288df7cef63c70dc5b79733f992de1
-
Filesize
130KB
MD5b89c1d2b412036667bb4e4c0ceb87d4a
SHA12fa90985ab89b1629febe5ed836bfd55c4480943
SHA25667e7d9f4fca46cda56078ce3fa0ba374d8225b376a093e484abb858de2148cb9
SHA512c717689bf796ff125912d9f30d7a763a11eb91bd9ab09b7201d687604f4cdba0cc1844c1bd7e26b2e3d9524ae1bf02d52319ee9519af0a0f357c120937c10e7e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82