dcf063747f44dfb97162010068962dfd1d4a6ee33ce245a030a294ce6c19e116

Analysis

max time kernel
134s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lpk.dll
Size 42KB
Sample241102-v722satnck
SHA256 ddf7073e755dd661565e8eb7b892372dc48a55fde09b1f07cda6e47ce7f8d650
MD5 4d691ae646b320e04bc2f5db3c245eb4
SHA1 e55533b8f117ed5cf0248f633c0e7f69d5226df6
SHA512 39f83db56c34c7a7f6d8dab0d2b073447276cb94dfd52c678fbd7a858c33de490fb1249d8d8c55114494fd1f01d07ca43defa210cc6926159c3a51e0f6992699
SSDEEP 768:ZojY9PqwzZNfYoMQxcttCIl1GRPKjECdVojY9P9:smlXPgtZTxECdAmF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2064	hrl7FA0.tmp
4048	bgvdci.exe

Loads dropped DLL 1 IoCs

pid	Process
4048	bgvdci.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bgvdci.exe	hrl7FA0.tmp
File opened for modification	C:\Windows\SysWOW64\bgvdci.exe	hrl7FA0.tmp
File created	C:\Windows\SysWOW64\hra33.dll	bgvdci.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hrl7FA0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bgvdci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2064	hrl7FA0.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 3460	1488	rundll32.exe	84
PID 1488 wrote to memory of 3460	1488	rundll32.exe	84
PID 1488 wrote to memory of 3460	1488	rundll32.exe	84
PID 3460 wrote to memory of 2064	3460	rundll32.exe	85
PID 3460 wrote to memory of 2064	3460	rundll32.exe	85
PID 3460 wrote to memory of 2064	3460	rundll32.exe	85
PID 2064 wrote to memory of 692	2064	hrl7FA0.tmp	87
PID 2064 wrote to memory of 692	2064	hrl7FA0.tmp	87
PID 2064 wrote to memory of 692	2064	hrl7FA0.tmp	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Users\Admin\AppData\Local\Temp\hrl7FA0.tmp
    C:\Users\Admin\AppData\Local\Temp\hrl7FA0.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\hrl7FA0.tmp > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:692

C:\Windows\SysWOW64\bgvdci.exe
C:\Windows\SysWOW64\bgvdci.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hrl7FA0.tmp

Path C:\Users\Admin\AppData\Local\Temp\hrl7FA0.tmp
Size 34KB
SHA256 88127c1ca940b5e087cb124f942761bffdefe2c73e4574570f1f914224083cf2
MD5 2d53ee91ed80e8a5a0134a7b7bc8097c
SHA1 a8df996004f0bae739b8d1a15a8fcc1d868d34e2
SHA512 ca70ee3311bd3b20f15776390fd3c5f0e438bba65669caf56e95cc94ed6ae17d4d7a9866908bfa5aa1732cd5fd56d269c4836b1754fdf718e3d6d8ea5a9e4e14
SSDEEP 768:4wzZNfYoMQxcttCIl1GRPKjECdVojY9P9y:bXPgtZTxECdAmFy
MD5 SHA1 SHA512 SSDEEP

Submit Download

hra33.dll

Path C:\Windows\SysWOW64\hra33.dll
Size 7KB
SHA256 fd08dcb016611316c849d48312ba6dc7d4de75d1a81c1d475a13bb5a1ba07267
MD5 7147ff24579a477a1a34696926e573f1
SHA1 9127ea8d813ecd5788b3f97777931ec79b7760e9
SHA512 077b68376679c30d2dbae460ed59f5131c177bdd7574af1c2660ed97ae242b1401816d012af321c278be065b49bc9eab395e008b1b9a2447aa27b694bbed1d5d
SSDEEP 96:u5u/ZbQ1T0AUjabtekE4vnFjgBEXK0U3FQfzchCa6JNY1fRd7Dy:uCbfkEsnFjF6VQQhCa6JNY1JI
MD5 SHA1 SHA512 SSDEEP