Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/11/2024, 10:51
Behavioral task
behavioral1
Sample
2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81N.dll
Resource
win7-20240903-en
General
-
Target
2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81N.dll
-
Size
80KB
-
MD5
ca0904c7c9c8f260335223101a2a9f80
-
SHA1
975429eefe193af74517cdfa44b6c8ab397fc08d
-
SHA256
2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81
-
SHA512
b3a6df2c89593ea100f1d8ab2b45c1fba5df7bcf85a18fdd8e99d5255b0e5329ee3a3e4b5437aef615270f9cae0d731fbaf0641653e70ebf59157720f48e53d3
-
SSDEEP
1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPEYgXfGhoxd:5dbwovEVyqgoZmZXWfIdQdRaefPtgXf/
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
pid Process 2708 arp.exe 2796 arp.exe 2192 arp.exe 2576 arp.exe 2824 arp.exe 2844 arp.exe 2720 arp.exe 3012 arp.exe 2568 arp.exe -
resource yara_rule behavioral1/memory/2724-0-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2192-1-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2192-4-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2724-6-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2720-8-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2576-7-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2708-13-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2796-12-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2824-14-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2844-11-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/3012-10-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2568-9-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2576-16-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/3012-26-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2824-30-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2720-29-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2708-25-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2568-23-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2844-20-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2796-19-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3036 2724 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2724 rundll32.exe Token: SeDebugPrivilege 2192 arp.exe Token: SeDebugPrivilege 2576 arp.exe Token: SeDebugPrivilege 2708 arp.exe Token: SeDebugPrivilege 2720 arp.exe Token: SeDebugPrivilege 2796 arp.exe Token: SeDebugPrivilege 3012 arp.exe Token: SeDebugPrivilege 2568 arp.exe Token: SeDebugPrivilege 2844 arp.exe Token: SeDebugPrivilege 2824 arp.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2724 3024 rundll32.exe 31 PID 3024 wrote to memory of 2724 3024 rundll32.exe 31 PID 3024 wrote to memory of 2724 3024 rundll32.exe 31 PID 3024 wrote to memory of 2724 3024 rundll32.exe 31 PID 3024 wrote to memory of 2724 3024 rundll32.exe 31 PID 3024 wrote to memory of 2724 3024 rundll32.exe 31 PID 3024 wrote to memory of 2724 3024 rundll32.exe 31 PID 2724 wrote to memory of 2192 2724 rundll32.exe 33 PID 2724 wrote to memory of 2192 2724 rundll32.exe 33 PID 2724 wrote to memory of 2192 2724 rundll32.exe 33 PID 2724 wrote to memory of 2192 2724 rundll32.exe 33 PID 2724 wrote to memory of 3036 2724 rundll32.exe 32 PID 2724 wrote to memory of 3036 2724 rundll32.exe 32 PID 2724 wrote to memory of 3036 2724 rundll32.exe 32 PID 2724 wrote to memory of 3036 2724 rundll32.exe 32 PID 2724 wrote to memory of 2576 2724 rundll32.exe 35 PID 2724 wrote to memory of 2576 2724 rundll32.exe 35 PID 2724 wrote to memory of 2576 2724 rundll32.exe 35 PID 2724 wrote to memory of 2576 2724 rundll32.exe 35 PID 2724 wrote to memory of 2796 2724 rundll32.exe 36 PID 2724 wrote to memory of 2796 2724 rundll32.exe 36 PID 2724 wrote to memory of 2796 2724 rundll32.exe 36 PID 2724 wrote to memory of 2796 2724 rundll32.exe 36 PID 2724 wrote to memory of 2824 2724 rundll32.exe 37 PID 2724 wrote to memory of 2824 2724 rundll32.exe 37 PID 2724 wrote to memory of 2824 2724 rundll32.exe 37 PID 2724 wrote to memory of 2824 2724 rundll32.exe 37 PID 2724 wrote to memory of 2844 2724 rundll32.exe 38 PID 2724 wrote to memory of 2844 2724 rundll32.exe 38 PID 2724 wrote to memory of 2844 2724 rundll32.exe 38 PID 2724 wrote to memory of 2844 2724 rundll32.exe 38 PID 2724 wrote to memory of 2568 2724 rundll32.exe 40 PID 2724 wrote to memory of 2568 2724 rundll32.exe 40 PID 2724 wrote to memory of 2568 2724 rundll32.exe 40 PID 2724 wrote to memory of 2568 2724 rundll32.exe 40 PID 2724 wrote to memory of 3012 2724 rundll32.exe 41 PID 2724 wrote to memory of 3012 2724 rundll32.exe 41 PID 2724 wrote to memory of 3012 2724 rundll32.exe 41 PID 2724 wrote to memory of 3012 2724 rundll32.exe 41 PID 2724 wrote to memory of 2720 2724 rundll32.exe 42 PID 2724 wrote to memory of 2720 2724 rundll32.exe 42 PID 2724 wrote to memory of 2720 2724 rundll32.exe 42 PID 2724 wrote to memory of 2720 2724 rundll32.exe 42 PID 2724 wrote to memory of 2708 2724 rundll32.exe 44 PID 2724 wrote to memory of 2708 2724 rundll32.exe 44 PID 2724 wrote to memory of 2708 2724 rundll32.exe 44 PID 2724 wrote to memory of 2708 2724 rundll32.exe 44
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 3043⤵
- Program crash
PID:3036
-
-
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 32-1a-fa-c5-6e-c53⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 28-e6-0c-d8-31-763⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\SysWOW64\arp.exearp -s 136.243.69.123 94-79-37-fd-74-5f3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 9b-36-fc-28-f6-8d3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 dd-9b-83-87-97-a33⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 b0-b1-4b-c2-0e-653⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 0a-3a-45-25-10-8e3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 79-e2-f0-0f-a5-7f3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-